emotet | ae4c42f61a8dd27587d87842c4fca32f6bde0f0ecf064791bb3eadaac5ccc4d6

Analysis

max time kernel
127s
max time network
129s
platform
windows7_x64
resource
win7-en-20211014
submitted
29/11/2021, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ee2a90e4f5b72f7182f7bfd45f3953.dll
Size 276KB
Sample211129-x2ncjsfff6
SHA256 ae4c42f61a8dd27587d87842c4fca32f6bde0f0ecf064791bb3eadaac5ccc4d6
MD5 01ee2a90e4f5b72f7182f7bfd45f3953
SHA1 01c0845d5b867a29f3d87beefa2c5e381e000ac4
SHA512 93d68970c32664f012c10a41e2b130e373435ba451e653070270b36704600018b28e9a0490e4a75032c922e8704c06f65f7bf3132501987f04159decff72dee6
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1468	rundll32.exe
6	1468	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1468	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 1604 wrote to memory of 2040	1604	rundll32.exe	27
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29
PID 2040 wrote to memory of 1468	2040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01ee2a90e4f5b72f7182f7bfd45f3953.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01ee2a90e4f5b72f7182f7bfd45f3953.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\01ee2a90e4f5b72f7182f7bfd45f3953.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-64-0x0000000000370000-0x0000000000398000-memory.dmp

Download

memory/1468-68-0x00000000003D0000-0x00000000003F8000-memory.dmp

Download

memory/1468-72-0x00000000009C0000-0x00000000009E8000-memory.dmp

Download

memory/1468-76-0x0000000002310000-0x0000000002338000-memory.dmp

Download

memory/1468-80-0x0000000002510000-0x0000000002538000-memory.dmp

Download

memory/1468-84-0x0000000002700000-0x0000000002728000-memory.dmp

Download

memory/1468-88-0x0000000002760000-0x0000000002788000-memory.dmp

Download

memory/2040-56-0x00000000754A1000-0x00000000754A3000-memory.dmp

Download

memory/2040-57-0x0000000000120000-0x0000000000144000-memory.dmp

Download

memory/2040-58-0x0000000000280000-0x00000000002A8000-memory.dmp

Download