emotet | ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7v20210410
submitted
06-05-2021 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cf2c56e_by_Libranalysis.exe
Size

419KB
MD5

9cf2c56ef2d9ed4c679013369c6bf4c0
SHA1

77a2d90daf8ccff12ba036924d49c0d57cfbc89b
SHA256

ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726
SHA512

824fa156c422176b7f41aeae17fe10ea40bd0cb4337a3093b76b7416add2412d6de606d12b0f50a9de0b68e92456728b4b6e1829f2c2324a667282c73a0e6598

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

47.148.241.179:80

24.204.47.87:80

80.86.91.91:8080

104.236.28.47:8080

87.106.136.232:8080

211.63.71.72:8080

113.52.123.226:7080

78.101.70.199:443

76.86.17.1:80

222.144.13.169:80

47.155.214.239:80

181.143.126.170:80

169.239.182.217:8080

181.126.70.117:80

209.137.209.84:443

207.177.72.129:8080

37.139.21.175:8080

149.202.153.252:8080

108.6.170.195:80

37.187.72.193:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

eappprxy.exe

pid process

948 eappprxy.exe
948 eappprxy.exe
948 eappprxy.exe
948 eappprxy.exe
948 eappprxy.exe
948 eappprxy.exe
948 eappprxy.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9cf2c56e_by_Libranalysis.exe

pid process

1996 9cf2c56e_by_Libranalysis.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9cf2c56e_by_Libranalysis.exeeappprxy.exe

pid process

1996 9cf2c56e_by_Libranalysis.exe
948 eappprxy.exe

pid	process
948	eappprxy.exe
948	eappprxy.exe
948	eappprxy.exe
948	eappprxy.exe
948	eappprxy.exe
948	eappprxy.exe
948	eappprxy.exe

pid	process
1996	9cf2c56e_by_Libranalysis.exe

pid	process
1996	9cf2c56e_by_Libranalysis.exe
948	eappprxy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9cf2c56e_by_Libranalysis.exe

description	pid	process	target process
PID 1996 wrote to memory of 948	1996	9cf2c56e_by_Libranalysis.exe	eappprxy.exe
PID 1996 wrote to memory of 948	1996	9cf2c56e_by_Libranalysis.exe	eappprxy.exe
PID 1996 wrote to memory of 948	1996	9cf2c56e_by_Libranalysis.exe	eappprxy.exe
PID 1996 wrote to memory of 948	1996	9cf2c56e_by_Libranalysis.exe	eappprxy.exe

C:\Users\Admin\AppData\Local\Temp\9cf2c56e_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\9cf2c56e_by_Libranalysis.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\eappprxy\eappprxy.exe
"C:\Windows\SysWOW64\eappprxy\eappprxy.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-63-0x0000000000000000-mapping.dmp

Download
memory/948-65-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/1996-59-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1996-60-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/1996-62-0x00000000002C0000-0x00000000002CA000-memory.dmp

Filesize
40KB

Download