emotet | d048f196a39fc7dae500b057fa000ebbb81ae2e6c18b4ddff445e8d7163f20ab

General

Target
c7e23f2764d6ed9b59b0fed69a4488b0.dll
Size 378KB
Sample211201-ycyyesfcgr
SHA256 d048f196a39fc7dae500b057fa000ebbb81ae2e6c18b4ddff445e8d7163f20ab
MD5 c7e23f2764d6ed9b59b0fed69a4488b0
SHA1 67f31b13485f91be7952b3df5628f14ef1c86a38
SHA512 1184f739b241155c46fda5c005af5010de100dd50f406965ae39701029a8304810359cc85e589eefc3afa494c3204fb467691b3f0b23c74eb32be26f3a4ca927
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

46.55.222.11:443
104.245.52.73:8080
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Urygegjotloz\retpcyvy.tfz	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4416	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4208	4116	rundll32.exe	69
PID 4116 wrote to memory of 4208	4116	rundll32.exe	69
PID 4116 wrote to memory of 4208	4116	rundll32.exe	69
PID 4208 wrote to memory of 4416	4208	rundll32.exe	70
PID 4208 wrote to memory of 4416	4208	rundll32.exe	70
PID 4208 wrote to memory of 4416	4208	rundll32.exe	70
PID 4416 wrote to memory of 4608	4416	rundll32.exe	73
PID 4416 wrote to memory of 4608	4416	rundll32.exe	73
PID 4416 wrote to memory of 4608	4416	rundll32.exe	73
PID 4608 wrote to memory of 2864	4608	rundll32.exe	74
PID 4608 wrote to memory of 2864	4608	rundll32.exe	74
PID 4608 wrote to memory of 2864	4608	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7e23f2764d6ed9b59b0fed69a4488b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7e23f2764d6ed9b59b0fed69a4488b0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c7e23f2764d6ed9b59b0fed69a4488b0.dll",Control_RunDLL
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Urygegjotloz\retpcyvy.tfz",lczmpMDsU
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Urygegjotloz\retpcyvy.tfz",Control_RunDLL
        5⤵
        
        PID:2864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4208-117-0x0000000000EB0000-0x0000000000FFA000-memory.dmp

Download

memory/4416-118-0x0000000003320000-0x0000000003347000-memory.dmp

Download

memory/4608-121-0x0000000000980000-0x0000000000ACA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads