emotet | 3b8bc38874c08524ed1158644d3f18eef94b89b7e10a75fe0eac2c7ea4fdee73

General

Target
3b8bc38874c08524ed1158644d3f18eef94b89b7e10a75fe0eac2c7ea4fdee73.dll
Size 384KB
Sample211201-mc4m5abddn
SHA256 3b8bc38874c08524ed1158644d3f18eef94b89b7e10a75fe0eac2c7ea4fdee73
MD5 b972d94df5912320314df0a710a13435
SHA1 690573cc227cf75c9f21a802bc79f4c6d541f5c3
SHA512 1b5938811c90cbe2ca5d5bd3a2143dd65b7204655da0b44698605de6c7a6cff9b6f8b125bd87f92c2380411084d3f6347bd4f5d749d89e98de6293e4cd5cc63a
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

46.55.222.11:443
104.245.52.73:8080
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mtyoaayzs\ivqgomv.sow	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
392	rundll32.exe
392	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4012	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4060	1012	rundll32.exe	69
PID 1012 wrote to memory of 4060	1012	rundll32.exe	69
PID 1012 wrote to memory of 4060	1012	rundll32.exe	69
PID 4060 wrote to memory of 4012	4060	rundll32.exe	70
PID 4060 wrote to memory of 4012	4060	rundll32.exe	70
PID 4060 wrote to memory of 4012	4060	rundll32.exe	70
PID 4012 wrote to memory of 3104	4012	rundll32.exe	71
PID 4012 wrote to memory of 3104	4012	rundll32.exe	71
PID 4012 wrote to memory of 3104	4012	rundll32.exe	71
PID 3104 wrote to memory of 392	3104	rundll32.exe	74
PID 3104 wrote to memory of 392	3104	rundll32.exe	74
PID 3104 wrote to memory of 392	3104	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8bc38874c08524ed1158644d3f18eef94b89b7e10a75fe0eac2c7ea4fdee73.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b8bc38874c08524ed1158644d3f18eef94b89b7e10a75fe0eac2c7ea4fdee73.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3b8bc38874c08524ed1158644d3f18eef94b89b7e10a75fe0eac2c7ea4fdee73.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mtyoaayzs\ivqgomv.sow",BRZt
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3104
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mtyoaayzs\ivqgomv.sow",Control_RunDLL
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-125-0x0000000002820000-0x00000000028CE000-memory.dmp

Download

memory/3104-124-0x0000000002960000-0x0000000002987000-memory.dmp

Download

memory/4012-122-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download

memory/4060-120-0x0000000002870000-0x000000000291E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads