emotet | 6cc3f5105b08d1123b9b62141e985dd81139dddf9fa347a74c4d9243127fd473

Analysis

max time kernel
256s
max time network
257s
platform
windows10_x64
resource
win10v20201028
submitted
26-01-2021 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cc3f5105b08d1123b9b62141e985dd81139dddf9fa347a74c4d9243127fd473.dll
Size

614KB
MD5

b856d7cc6d14434488358da6f72be1e4
SHA1

4f0de07fbe4d90aa2467029c7641c089cd97dbf4
SHA256

6cc3f5105b08d1123b9b62141e985dd81139dddf9fa347a74c4d9243127fd473
SHA512

d3e6981ca7d22be4c47748a3423168a18f24ea1c7e13ad4692e378bcc2a21f1a415d3214e3e4660751b5a6ff22f71883ea6b84898e95da22a5db5c0b0c37ec1d

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

11 8 rundll32.exe
16 8 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

8 rundll32.exe
8 rundll32.exe
8 rundll32.exe
8 rundll32.exe
8 rundll32.exe
8 rundll32.exe

flow	pid	process
11	8	rundll32.exe
16	8	rundll32.exe

pid	process
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe
8	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 648 wrote to memory of 8	648	rundll32.exe	rundll32.exe
PID 648 wrote to memory of 8	648	rundll32.exe	rundll32.exe
PID 648 wrote to memory of 8	648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cc3f5105b08d1123b9b62141e985dd81139dddf9fa347a74c4d9243127fd473.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cc3f5105b08d1123b9b62141e985dd81139dddf9fa347a74c4d9243127fd473.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-2-0x0000000000000000-mapping.dmp

Download
memory/8-3-0x0000000004BD0000-0x0000000004BF6000-memory.dmp

Filesize
152KB

Download
memory/8-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download