emotet | afbd4bcadb81bfc681b10def38b1b984999429e28390e62284947bb134552fa4

Analysis

max time kernel
35s
max time network
136s
platform
windows10_x64
resource
win10v20201028
submitted
26-01-2021 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afbd4bcadb81bfc681b10def38b1b984999429e28390e62284947bb134552fa4.dll
Size

614KB
MD5

236ad1b739cbdb8fd69c06e80ac304dc
SHA1

50093dacd8764847cb884b3feb1f85a114ae35ac
SHA256

afbd4bcadb81bfc681b10def38b1b984999429e28390e62284947bb134552fa4
SHA512

3cd15e4527631d52b10e38d2a1550590e0fb786535ae0e70429bd6cacd30a27ed75e37eaff481df9ba89d9558f62a3632957265f648285bb7e6577553153b238

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

15 8 rundll32.exe
19 8 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

8 rundll32.exe
8 rundll32.exe
8 rundll32.exe
8 rundll32.exe
8 rundll32.exe
8 rundll32.exe

flow	pid	process
15	8	rundll32.exe
19	8	rundll32.exe

pid	process
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 988 wrote to memory of 8	988	rundll32.exe	rundll32.exe
PID 988 wrote to memory of 8	988	rundll32.exe	rundll32.exe
PID 988 wrote to memory of 8	988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afbd4bcadb81bfc681b10def38b1b984999429e28390e62284947bb134552fa4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\afbd4bcadb81bfc681b10def38b1b984999429e28390e62284947bb134552fa4.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-2-0x0000000000000000-mapping.dmp

Download
memory/8-3-0x0000000004301000-0x0000000004364000-memory.dmp

Filesize
396KB

Download
memory/8-5-0x0000000004300000-0x0000000004323000-memory.dmp

Filesize
140KB

Download
memory/8-4-0x0000000000C20000-0x0000000000C46000-memory.dmp

Filesize
152KB

Download