emotet | ae4c42f61a8dd27587d87842c4fca32f6bde0f0ecf064791bb3eadaac5ccc4d6

Analysis

max time kernel
120s
max time network
127s
platform
windows10_x64
resource
win10-en-20211104
submitted
29/11/2021, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ee2a90e4f5b72f7182f7bfd45f3953.dll
Size 276KB
Sample211129-x2ncjsfff6
SHA256 ae4c42f61a8dd27587d87842c4fca32f6bde0f0ecf064791bb3eadaac5ccc4d6
MD5 01ee2a90e4f5b72f7182f7bfd45f3953
SHA1 01c0845d5b867a29f3d87beefa2c5e381e000ac4
SHA512 93d68970c32664f012c10a41e2b130e373435ba451e653070270b36704600018b28e9a0490e4a75032c922e8704c06f65f7bf3132501987f04159decff72dee6
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	3792	rundll32.exe
17	3792	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	rundll32.exe
3792	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3716	3684	rundll32.exe	68
PID 3684 wrote to memory of 3716	3684	rundll32.exe	68
PID 3684 wrote to memory of 3716	3684	rundll32.exe	68
PID 3716 wrote to memory of 3792	3716	rundll32.exe	69
PID 3716 wrote to memory of 3792	3716	rundll32.exe	69
PID 3716 wrote to memory of 3792	3716	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01ee2a90e4f5b72f7182f7bfd45f3953.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01ee2a90e4f5b72f7182f7bfd45f3953.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\01ee2a90e4f5b72f7182f7bfd45f3953.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-119-0x0000000004900000-0x0000000004928000-memory.dmp

Download

memory/3792-123-0x0000000000CB0000-0x0000000000CD8000-memory.dmp

Download

memory/3792-126-0x00000000046F0000-0x0000000004718000-memory.dmp

Download

memory/3792-129-0x00000000047D0000-0x00000000047F8000-memory.dmp

Download

memory/3792-132-0x00000000048B0000-0x00000000048D8000-memory.dmp

Download

memory/3792-135-0x0000000004990000-0x00000000049B8000-memory.dmp

Download

memory/3792-138-0x0000000004B70000-0x0000000004B98000-memory.dmp

Download

memory/3792-141-0x0000000004C50000-0x0000000004C78000-memory.dmp

Download