emotet | a7df28656f94c9d351d16b91a19c9f4743172e52d01f45b804b85c26a5ba0a21

General

Target
emotet_exe_e5_a7df28656f94c9d351d16b91a19c9f4743172e52d01f45b804b85c26a5ba0a21_2021-12-01__222205.exe.dll
Size 364KB
Sample211201-2ar9msbeg6
SHA256 a7df28656f94c9d351d16b91a19c9f4743172e52d01f45b804b85c26a5ba0a21
MD5 c98e608ee3117a58d85d906b399c5bb4
SHA1 7591513bac1fba9d763f738255a7b118db309057
SHA512 f2c4b2a6f8c55ecfa2ddaf4f4aa0d51f1488eaa47dfc07435a3a016e1e12d2e4cd54a1553314f40cc6a6c7a7a18fc03312d5519999607dfce0f3fdff4236698d
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tkdcehgmoin\kzac.ape	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2564	3252	rundll32.exe	69
PID 3252 wrote to memory of 2564	3252	rundll32.exe	69
PID 3252 wrote to memory of 2564	3252	rundll32.exe	69
PID 2564 wrote to memory of 1680	2564	rundll32.exe	70
PID 2564 wrote to memory of 1680	2564	rundll32.exe	70
PID 2564 wrote to memory of 1680	2564	rundll32.exe	70
PID 1680 wrote to memory of 688	1680	rundll32.exe	73
PID 1680 wrote to memory of 688	1680	rundll32.exe	73
PID 1680 wrote to memory of 688	1680	rundll32.exe	73
PID 688 wrote to memory of 1532	688	rundll32.exe	74
PID 688 wrote to memory of 1532	688	rundll32.exe	74
PID 688 wrote to memory of 1532	688	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a7df28656f94c9d351d16b91a19c9f4743172e52d01f45b804b85c26a5ba0a21_2021-12-01__222205.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a7df28656f94c9d351d16b91a19c9f4743172e52d01f45b804b85c26a5ba0a21_2021-12-01__222205.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a7df28656f94c9d351d16b91a19c9f4743172e52d01f45b804b85c26a5ba0a21_2021-12-01__222205.exe.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tkdcehgmoin\kzac.ape",HMvByyYTEuVeMGN
      4⤵
      Suspicious use of WriteProcessMemory
      PID:688
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Tkdcehgmoin\kzac.ape",Control_RunDLL
        5⤵
        
        PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/688-124-0x0000000003260000-0x00000000033AA000-memory.dmp

Download

memory/1680-121-0x0000000002A70000-0x0000000002A97000-memory.dmp

Download

memory/2564-120-0x0000000002E60000-0x0000000002F0E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads