emotet | 534a598ae3170e8f39e8cc1fb1976a8bbeb418128fb23fde6420fe624eee2ec6

General

Target

ptrjctad.rmz.dll
Size

342KB
MD5

ea8d08d8faecc54887e4dc2be3b3b341
SHA1

2811f4b31e912a40b871b96f3f7c15d3d4c0ffb9
SHA256

534a598ae3170e8f39e8cc1fb1976a8bbeb418128fb23fde6420fe624eee2ec6
SHA512

089dfcc735aecdbf57251eb24dce7c7df8fa23f5c2bdd15da3b61d7f77bf4626ef93c5d24873b19b939278dac1b8e4f700d80e4876e3e0164b361fcd773bab5e

Score

10^/10

emotet epoch2 lea banker ransomware trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

12.175.220.98:80

162.241.204.233:8080

50.116.111.59:8080

172.86.188.251:8080

139.99.158.11:443

66.57.108.14:443

75.177.207.146:80

194.190.67.75:80

50.245.107.73:443

173.70.61.180:80

85.105.205.77:8080

104.131.11.150:443

62.75.141.82:80

70.92.118.112:80

194.4.58.192:7080

120.150.60.189:80

24.231.88.85:80

78.24.219.147:8080

110.142.236.207:80

119.59.116.21:8080

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

LEA

C2

80.158.3.161:443

80.158.51.209:8080

80.158.35.51:80

80.158.63.78:443

80.158.53.167:80

80.158.62.194:443

80.158.59.174:8080

80.158.43.136:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

12 1212 rundll32.exe
14 1212 rundll32.exe
16 1212 rundll32.exe
17 1212 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1580 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Temp\ptrjctad.rmz.dll rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

flow	pid	process
12	1212	rundll32.exe
14	1212	rundll32.exe
16	1212	rundll32.exe
17	1212	rundll32.exe

pid	process
1580	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Temp\ptrjctad.rmz.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exerundll32.exe

pid	process
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1152 wrote to memory of 1212	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1212	1152	rundll32.exe	rundll32.exe
PID 1152 wrote to memory of 1212	1152	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1580	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1580	1212	rundll32.exe	rundll32.exe
PID 1212 wrote to memory of 1580	1212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ptrjctad.rmz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ptrjctad.rmz.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\qnaiqhft.dll",#1 xAQAACwAAABUAGUAbQBwAFwAcAB0AHIAagBjAHQAYQBkAC4AcgBtAHoALgBkAGwAbAAAAA==
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qnaiqhft.dll
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc

SHA1
fc83367be87c700a696b0329dab538b5e47d90bf

SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

Download Submit
\Users\Admin\AppData\Local\Temp\qnaiqhft.dll
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc

SHA1
fc83367be87c700a696b0329dab538b5e47d90bf

SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

Download Submit
memory/1212-2-0x0000000000000000-mapping.dmp

Download
memory/1212-3-0x0000000000AE0000-0x0000000000B00000-memory.dmp

Filesize
128KB

Download
memory/1212-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1580-5-0x0000000000000000-mapping.dmp

Download
memory/1580-8-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/1580-9-0x0000000002D80000-0x0000000002D9D000-memory.dmp

Filesize
116KB

Download
memory/1580-10-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads