emotet | 8227c8aa29852aeab503c7aba0e67508e2694c1ae32d4692b7329e9f528ce105

Analysis

max time kernel
250s
max time network
252s
platform
windows10_x64
resource
win10v20201028
submitted
26-01-2021 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8227c8aa29852aeab503c7aba0e67508e2694c1ae32d4692b7329e9f528ce105.dll
Size

614KB
MD5

7157f39cb1d5f50961d6b80a0e5e4b3e
SHA1

31dace208bb2f9a88018425a981ecdd3ec1d3e0f
SHA256

8227c8aa29852aeab503c7aba0e67508e2694c1ae32d4692b7329e9f528ce105
SHA512

f2c91e4c27e928e17221ab12d0346b898cbcf822ccd51581653636b0297e44167b4267c044f0cd2ff5c712e1ea4c0246b7e35f3f9a1250001744bb6b753ec9df

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

181.165.68.127:80

49.205.182.134:80

190.251.200.206:80

139.59.60.244:8080

119.59.116.21:8080

89.216.122.92:80

185.94.252.104:443

70.92.118.112:80

78.24.219.147:8080

173.70.61.180:80

87.106.139.101:8080

66.57.108.14:443

24.179.13.119:80

121.124.124.40:7080

61.19.246.238:443

200.116.145.225:443

93.146.48.84:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

14 64 rundll32.exe
16 64 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

64 rundll32.exe
64 rundll32.exe
64 rundll32.exe
64 rundll32.exe
64 rundll32.exe
64 rundll32.exe

flow	pid	process
14	64	rundll32.exe
16	64	rundll32.exe

pid	process
64	rundll32.exe
64	rundll32.exe
64	rundll32.exe
64	rundll32.exe
64	rundll32.exe
64	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 740 wrote to memory of 64	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 64	740	rundll32.exe	rundll32.exe
PID 740 wrote to memory of 64	740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8227c8aa29852aeab503c7aba0e67508e2694c1ae32d4692b7329e9f528ce105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8227c8aa29852aeab503c7aba0e67508e2694c1ae32d4692b7329e9f528ce105.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-2-0x0000000000000000-mapping.dmp

Download
memory/64-3-0x0000000000531000-0x0000000000594000-memory.dmp

Filesize
396KB

Download
memory/64-4-0x0000000000B10000-0x0000000000B36000-memory.dmp

Filesize
152KB

Download
memory/64-5-0x0000000000530000-0x0000000000553000-memory.dmp

Filesize
140KB

Download