emotet | 6d679474a78796803d07ce6fe31a215ac9f5de7e6cc4e29ccfff6cd809af2360

Analysis

max time kernel
109s
max time network
125s
platform
windows10_x64
resource
win10-en-20211014
submitted
28/11/2021, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d69f5eb6dae10615c594e20fd10096a.dll
Size 696KB
Sample211128-3sa9hsdgg5
SHA256 6d679474a78796803d07ce6fe31a215ac9f5de7e6cc4e29ccfff6cd809af2360
MD5 9d69f5eb6dae10615c594e20fd10096a
SHA1 6d69438e22159a053883415bbcb5aec64c673abc
SHA512 a31ac7f337910c4a4d41654c4287a8304d26c6e54aa8875266df702d25de64edf15db69dfb415f7db26a355a362ee96e158f0639c455b1cfc9ec5384b5b0a288
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	2040	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Wvbducnn\xfqrhmwi.bzk	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2040	rundll32.exe
2040	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2324	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2696	3764	rundll32.exe	69
PID 3764 wrote to memory of 2696	3764	rundll32.exe	69
PID 3764 wrote to memory of 2696	3764	rundll32.exe	69
PID 2696 wrote to memory of 2324	2696	rundll32.exe	70
PID 2696 wrote to memory of 2324	2696	rundll32.exe	70
PID 2696 wrote to memory of 2324	2696	rundll32.exe	70
PID 2324 wrote to memory of 1272	2324	rundll32.exe	71
PID 2324 wrote to memory of 1272	2324	rundll32.exe	71
PID 2324 wrote to memory of 1272	2324	rundll32.exe	71
PID 1272 wrote to memory of 2040	1272	rundll32.exe	72
PID 1272 wrote to memory of 2040	1272	rundll32.exe	72
PID 1272 wrote to memory of 2040	1272	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d69f5eb6dae10615c594e20fd10096a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d69f5eb6dae10615c594e20fd10096a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9d69f5eb6dae10615c594e20fd10096a.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wvbducnn\xfqrhmwi.bzk",ZzWsrTZwkwoi
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Wvbducnn\xfqrhmwi.bzk",Control_RunDLL
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-136-0x00000000032D0000-0x00000000032F8000-memory.dmp

Download

memory/2040-143-0x00000000046D0000-0x00000000046F8000-memory.dmp

Download

memory/2040-152-0x0000000005040000-0x0000000005068000-memory.dmp

Download

memory/2040-161-0x0000000005310000-0x0000000005338000-memory.dmp

Download

memory/2040-158-0x0000000005210000-0x0000000005238000-memory.dmp

Download

memory/2040-155-0x0000000005120000-0x0000000005148000-memory.dmp

Download

memory/2040-149-0x0000000004F50000-0x0000000004F78000-memory.dmp

Download

memory/2040-146-0x0000000004E70000-0x0000000004E98000-memory.dmp

Download

memory/2324-139-0x0000000005500000-0x0000000005528000-memory.dmp

Download

memory/2324-132-0x00000000053A0000-0x00000000053C8000-memory.dmp

Download

memory/2324-120-0x0000000004B40000-0x0000000004B68000-memory.dmp

Download

memory/2324-129-0x0000000005340000-0x0000000005368000-memory.dmp

Download

memory/2324-126-0x00000000051B0000-0x00000000051D8000-memory.dmp

Download

memory/2324-123-0x00000000050D0000-0x00000000050F8000-memory.dmp

Download

memory/2696-116-0x00000000043A0000-0x00000000043C8000-memory.dmp

Download