emotet | f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7

General

Target
emotet_exe_e5_f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7_2021-11-26__000055.exe.dll
Size 527KB
Sample211126-aawtaahdfm
SHA256 f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7
MD5 88497f6bc31b67489bd6e4cca45339b7
SHA1 6eb5d7b1fcb5969cf43bafbac3935df765399513
SHA512 8f21d9b73f9cc7a3e40537891d240fb5c9d64ffa6a4262baeb167e4d2ae8cc0aa6c5adcf72851a97af318098ca285fdeae9e9d6ac73a8d4d8f0c1abf46592efb
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

91.200.186.228:443
41.76.108.46:8080
188.165.214.166:7080
191.252.196.221:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 3 IoCs

flow	pid	Process
16	2100	rundll32.exe
23	2100	rundll32.exe
25	2100	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	rundll32.exe
2100	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2772	2700	rundll32.exe	68
PID 2700 wrote to memory of 2772	2700	rundll32.exe	68
PID 2700 wrote to memory of 2772	2700	rundll32.exe	68
PID 2772 wrote to memory of 2100	2772	rundll32.exe	69
PID 2772 wrote to memory of 2100	2772	rundll32.exe	69
PID 2772 wrote to memory of 2100	2772	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7_2021-11-26__000055.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7_2021-11-26__000055.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7_2021-11-26__000055.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-120-0x0000000004BB0000-0x0000000004BD8000-memory.dmp

Download

memory/2100-123-0x00000000051C0000-0x00000000051E8000-memory.dmp

Download

memory/2100-126-0x00000000052A0000-0x00000000052C8000-memory.dmp

Download

memory/2100-129-0x0000000005380000-0x00000000053A8000-memory.dmp

Download

memory/2100-132-0x0000000005460000-0x0000000005488000-memory.dmp

Download

memory/2100-135-0x0000000005640000-0x0000000005668000-memory.dmp

Download

memory/2100-138-0x0000000005740000-0x0000000005768000-memory.dmp

Download

memory/2772-117-0x00000000045E0000-0x0000000004608000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads