emotet | e8fddaeb4d8aa0fc9be10bb1bfc082946229de49659a59de1810b044dfd71a0a

General

Target
emotet_exe_e4_e8fddaeb4d8aa0fc9be10bb1bfc082946229de49659a59de1810b044dfd71a0a_2021-12-01__093753.exe.dll
Size 378KB
Sample211201-ll2pfsbcal
SHA256 e8fddaeb4d8aa0fc9be10bb1bfc082946229de49659a59de1810b044dfd71a0a
MD5 06c23c7af3c61e833a50dac81cc88694
SHA1 ce61561833017ce21b8c7f044450d36032cc4765
SHA512 407df30cbafddf483771c54d01e7151e69357af465abbf9bf7215de3d44f0bd542d84c7d932a9f350cc89f76dbed123dc2e32f49ea799d5c646ac3e731d755c1
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

46.55.222.11:443
104.245.52.73:8080
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Apijqdynktw\nrferh.spc	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3928	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3300	3032	rundll32.exe	69
PID 3032 wrote to memory of 3300	3032	rundll32.exe	69
PID 3032 wrote to memory of 3300	3032	rundll32.exe	69
PID 3300 wrote to memory of 3928	3300	rundll32.exe	70
PID 3300 wrote to memory of 3928	3300	rundll32.exe	70
PID 3300 wrote to memory of 3928	3300	rundll32.exe	70
PID 3928 wrote to memory of 1244	3928	rundll32.exe	73
PID 3928 wrote to memory of 1244	3928	rundll32.exe	73
PID 3928 wrote to memory of 1244	3928	rundll32.exe	73
PID 1244 wrote to memory of 608	1244	rundll32.exe	74
PID 1244 wrote to memory of 608	1244	rundll32.exe	74
PID 1244 wrote to memory of 608	1244	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e8fddaeb4d8aa0fc9be10bb1bfc082946229de49659a59de1810b044dfd71a0a_2021-12-01__093753.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e8fddaeb4d8aa0fc9be10bb1bfc082946229de49659a59de1810b044dfd71a0a_2021-12-01__093753.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e8fddaeb4d8aa0fc9be10bb1bfc082946229de49659a59de1810b044dfd71a0a_2021-12-01__093753.exe.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Apijqdynktw\nrferh.spc",PxDyN
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Apijqdynktw\nrferh.spc",Control_RunDLL
        5⤵
        
        PID:608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-121-0x00000000003C0000-0x00000000003E7000-memory.dmp

Download

memory/3300-116-0x0000000000600000-0x0000000000627000-memory.dmp

Download

memory/3928-118-0x0000000000470000-0x0000000000497000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads