ptrjctad.rmz
ptrjctad.rmz.dll
342KB
04-02-2021 15:06
ea8d08d8faecc54887e4dc2be3b3b341
2811f4b31e912a40b871b96f3f7c15d3d4c0ffb9
534a598ae3170e8f39e8cc1fb1976a8bbeb418128fb23fde6420fe624eee2ec6
Extracted
| Family | emotet |
| Botnet | Epoch2 |
| C2 |
12.175.220.98:80 162.241.204.233:8080 50.116.111.59:8080 172.86.188.251:8080 139.99.158.11:443 66.57.108.14:443 75.177.207.146:80 194.190.67.75:80 50.245.107.73:443 173.70.61.180:80 85.105.205.77:8080 104.131.11.150:443 62.75.141.82:80 70.92.118.112:80 194.4.58.192:7080 120.150.60.189:80 24.231.88.85:80 78.24.219.147:8080 110.142.236.207:80 119.59.116.21:8080 144.217.7.207:7080 95.213.236.64:8080 46.105.131.79:8080 176.111.60.55:8080 174.118.202.24:443 94.23.237.171:443 138.68.87.218:443 110.145.101.66:443 134.209.144.106:443 74.208.45.104:8080 24.178.90.49:80 172.125.40.123:80 157.245.99.39:8080 118.83.154.64:443 202.134.4.211:8080 121.124.124.40:7080 172.104.97.173:8080 110.145.11.73:80 172.105.13.66:443 168.235.67.138:7080 78.188.225.105:80 59.21.235.119:80 185.94.252.104:443 24.179.13.119:80 49.205.182.134:80 51.89.36.180:443 115.21.224.117:80 202.134.4.216:8080 190.251.200.206:80 78.189.148.42:80 |
| rsa_pubkey.plain |
|
Filter: none
-
Emotet
Description
Emotet is a trojan that is primarily spread through spam emails.
Tags
-
Blocklisted process makes network requestrundll32.exe
Reported IOCs
flow pid process 6 1912 rundll32.exe 9 1912 rundll32.exe 10 1912 rundll32.exe 13 1912 rundll32.exe 14 1912 rundll32.exe 17 1912 rundll32.exe -
Suspicious behavior: EnumeratesProcessesrundll32.exe
Reported IOCs
pid process 1912 rundll32.exe 1912 rundll32.exe 1912 rundll32.exe 1912 rundll32.exe -
Suspicious use of WriteProcessMemoryrundll32.exe
Reported IOCs
description pid process target process PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe PID 380 wrote to memory of 1912 380 rundll32.exe rundll32.exe
-
C:\Windows\system32\rundll32.exePID:380rundll32.exe C:\Users\Admin\AppData\Local\Temp\ptrjctad.rmz.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:1912rundll32.exe C:\Users\Admin\AppData\Local\Temp\ptrjctad.rmz.dll,#1Blocklisted process makes network requestSuspicious behavior: EnumeratesProcesses
-
memory/1296-6-0x000007FEF7D40000-0x000007FEF7FBA000-memory.dmp
-
memory/1912-2-0x0000000000000000-mapping.dmp
-
memory/1912-3-0x0000000075D01000-0x0000000075D03000-memory.dmp
-
memory/1912-4-0x00000000001F0000-0x0000000000210000-memory.dmp
-
memory/1912-5-0x0000000010000000-0x0000000010023000-memory.dmp