emotet | 9b6a6dbf1c6c44e80d04fabdac75b451f704a2eaa15768075d2e409c62d92330

General

Target

8fe3fde9e0a98332e4a8b7b65eadd1745c8e1c29b1bfd5974bd018d255e139e9.dll
Size

609KB
MD5

015c80d341a3aebc2b30d6ed28a663b5
SHA1

26b8e9a1ad9b66bc0944f01ace690046f829ad32
SHA256

8fe3fde9e0a98332e4a8b7b65eadd1745c8e1c29b1bfd5974bd018d255e139e9
SHA512

43ba89dc4b7392474b814536ae604040568f2bd15fb1cbf3de29c2aad489f835a2ab7d21ef7975cf036ba997d5de8eeda1540b078e59ca6de4ddb1a0e4798b78

Score

10^/10

emotet epoch3 lea banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.55.186.229:80

203.157.152.9:7080

157.245.145.87:443

132.248.38.158:80

110.172.180.180:8080

70.32.89.105:8080

161.49.84.2:80

37.46.129.215:8080

50.116.78.109:8080

115.79.195.246:80

178.62.254.156:8080

175.103.38.146:80

188.226.165.170:8080

91.93.3.85:8080

162.144.145.58:8080

117.2.139.117:443

190.85.46.52:7080

201.193.160.196:80

152.32.75.74:443

195.201.56.70:8080

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

LEA

C2

80.158.3.161:443

80.158.51.209:8080

80.158.35.51:80

80.158.63.78:443

80.158.53.167:80

80.158.62.194:443

80.158.59.174:8080

80.158.43.136:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

12 2608 rundll32.exe
16 2608 rundll32.exe
18 2608 rundll32.exe
19 840 rundll32.exe
Deletes itself 1 IoCs

Processes:

rundll32.exe

pid process

840 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2712 rundll32.exe

flow	pid	process
12	2608	rundll32.exe
16	2608	rundll32.exe
18	2608	rundll32.exe
19	840	rundll32.exe

pid	process
840	rundll32.exe

pid	process
2712	rundll32.exe

Drops file in System32 directory 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ntdqmrhhvilijlrb\kxlyhjqzpkpqbsk.kqk	rundll32.exe
File created	C:\Windows\SysWOW64\Ntdqmrhhvilijlrb\xtjluypikcnf.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Ntdqmrhhvilijlrb\kxlyhjqzpkpqbsk.kqk	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid	process
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2608	rundll32.exe
2712	rundll32.exe
2712	rundll32.exe
840	rundll32.exe
840	rundll32.exe
840	rundll32.exe
840	rundll32.exe
840	rundll32.exe
840	rundll32.exe

Suspicious behavior: RenamesItself 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1384 rundll32.exe
2712 rundll32.exe

pid	process
1384	rundll32.exe
2712	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 1384	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1384	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1384	1192	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 900	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 900	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 900	1384	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 2608	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 2608	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 2608	900	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2712	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2712	2608	rundll32.exe	rundll32.exe
PID 2608 wrote to memory of 2712	2608	rundll32.exe	rundll32.exe
PID 2712 wrote to memory of 840	2712	rundll32.exe	rundll32.exe
PID 2712 wrote to memory of 840	2712	rundll32.exe	rundll32.exe
PID 2712 wrote to memory of 840	2712	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe3fde9e0a98332e4a8b7b65eadd1745c8e1c29b1bfd5974bd018d255e139e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fe3fde9e0a98332e4a8b7b65eadd1745c8e1c29b1bfd5974bd018d255e139e9.dll,#1
2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ntdqmrhhvilijlrb\kxlyhjqzpkpqbsk.kqk",znCZEooAkmYv
3⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ntdqmrhhvilijlrb\kxlyhjqzpkpqbsk.kqk",#1
4⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ntdqmrhhvilijlrb\xtjluypikcnf.dll",#1 wAQAAEoAAABOAHQAZABxAG0AcgBoAGgAdgBpAGwAaQBqAGwAcgBiAFwAawB4AGwAeQBoAGoAcQB6AHAAawBwAHEAYgBzAGsALgBrAHEAawAAAA==
5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ntdqmrhhvilijlrb\kxlyhjqzpkpqbsk.kqk",Control_RunDLL
6⤵
- Blocklisted process makes network request
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ntdqmrhhvilijlrb\xtjluypikcnf.dll
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc

SHA1
fc83367be87c700a696b0329dab538b5e47d90bf

SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

Download Submit
\Windows\SysWOW64\Ntdqmrhhvilijlrb\xtjluypikcnf.dll
MD5
9a062ead5b2d55af0a5a4b39c5b5eadc

SHA1
fc83367be87c700a696b0329dab538b5e47d90bf

SHA256
a9c68d527223db40014d067cf4fdae5be46cca67387e9cfdff118276085f23ef

SHA512
693ab862c7e3c5dad3ca3d44bbc4a5a4c2391ff558e02e86e4c1d7d1fa7c00b4acf1c426ca619dea2b422997caaf1f0ecba37ec0ffca19edaca297005c9ad861

Download Submit
memory/840-19-0x0000000004890000-0x00000000048B0000-memory.dmp

Filesize
128KB

Download
memory/840-17-0x0000000000000000-mapping.dmp

Download
memory/900-5-0x0000000000000000-mapping.dmp

Download
memory/1384-2-0x0000000000000000-mapping.dmp

Download
memory/1384-4-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1384-3-0x0000000004C40000-0x0000000004C65000-memory.dmp

Filesize
148KB

Download
memory/2608-6-0x0000000000000000-mapping.dmp

Download
memory/2712-11-0x0000000000000000-mapping.dmp

Download
memory/2712-14-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/2712-16-0x0000000000F10000-0x0000000000F30000-memory.dmp

Filesize
128KB

Download
memory/2712-15-0x0000000000D50000-0x0000000000D6D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads