emotet | c93e5a17841fc576f5d29d7fd2db5a22429ca7fc2a3a50af6817b81989b3988d

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-en-20211014
submitted
27/11/2021, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b53c03d154a951d6c4966fc9f93ed2a.dll
Size 696KB
Sample211127-d63s9abff3
SHA256 c93e5a17841fc576f5d29d7fd2db5a22429ca7fc2a3a50af6817b81989b3988d
MD5 5b53c03d154a951d6c4966fc9f93ed2a
SHA1 b6c54682ac42e8876f1776395ee408fecc51938a
SHA512 b349e96e8eb561eeede38ffa2135869f613728c43fd10df9d43f222141a8e43f5f965738da7e8a43afa1e124f8a33db52bc4655ebb8fce1ad0d032478403245c
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

91.200.186.228:443
41.76.108.46:8080
188.165.214.166:7080
191.252.196.221:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	568	rundll32.exe
5	568	rundll32.exe
6	568	rundll32.exe
8	568	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
568	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 892 wrote to memory of 1176	892	rundll32.exe	27
PID 1176 wrote to memory of 568	1176	rundll32.exe	29
PID 1176 wrote to memory of 568	1176	rundll32.exe	29
PID 1176 wrote to memory of 568	1176	rundll32.exe	29
PID 1176 wrote to memory of 568	1176	rundll32.exe	29
PID 1176 wrote to memory of 568	1176	rundll32.exe	29
PID 1176 wrote to memory of 568	1176	rundll32.exe	29
PID 1176 wrote to memory of 568	1176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b53c03d154a951d6c4966fc9f93ed2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b53c03d154a951d6c4966fc9f93ed2a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5b53c03d154a951d6c4966fc9f93ed2a.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-64-0x0000000000230000-0x0000000000258000-memory.dmp

Download

memory/568-68-0x00000000003C0000-0x00000000003E8000-memory.dmp

Download

memory/568-72-0x0000000000420000-0x0000000000448000-memory.dmp

Download

memory/568-76-0x0000000000BF0000-0x0000000000C18000-memory.dmp

Download

memory/568-80-0x0000000002550000-0x0000000002578000-memory.dmp

Download

memory/568-84-0x0000000002700000-0x0000000002728000-memory.dmp

Download

memory/568-88-0x0000000002B61000-0x0000000002B84000-memory.dmp

Download

memory/1176-56-0x00000000754F1000-0x00000000754F3000-memory.dmp

Download

memory/1176-57-0x00000000003F0000-0x0000000000414000-memory.dmp

Download

memory/1176-58-0x0000000000630000-0x0000000000658000-memory.dmp

Download