emotet | 26099e7fa189669812ed5117ae4f85463505e563eeece64c085bb8d0ff01ea65

General

Target
emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll
Size 653KB
Sample211217-wtql9seac8
SHA256 26099e7fa189669812ed5117ae4f85463505e563eeece64c085bb8d0ff01ea65
MD5 7ffc8b580689321818b47c53a3faefcc
SHA1 ea57ba3db0f0c774e6acb6e25a72dfdda5ec2607
SHA512 f205a54ee6f94fddf22786056e2372f4878c8cbd5b3917649303a0c7024a7d347263b9c0635c67baccb2fe79431365fc6bcbc3cc9727252ce06011b7ff6d17d4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	336	rundll32.exe
6	336	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
336	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1940 wrote to memory of 1900	1940	rundll32.exe	27
PID 1900 wrote to memory of 336	1900	rundll32.exe	28
PID 1900 wrote to memory of 336	1900	rundll32.exe	28
PID 1900 wrote to memory of 336	1900	rundll32.exe	28
PID 1900 wrote to memory of 336	1900	rundll32.exe	28
PID 1900 wrote to memory of 336	1900	rundll32.exe	28
PID 1900 wrote to memory of 336	1900	rundll32.exe	28
PID 1900 wrote to memory of 336	1900	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-63-0x00000000003A0000-0x00000000003C8000-memory.dmp

Download

memory/336-67-0x0000000000490000-0x00000000004B8000-memory.dmp

Download

memory/336-71-0x0000000000720000-0x0000000000748000-memory.dmp

Download

memory/336-75-0x0000000002320000-0x0000000002348000-memory.dmp

Download

memory/336-79-0x0000000002410000-0x0000000002438000-memory.dmp

Download

memory/336-83-0x0000000002650000-0x0000000002678000-memory.dmp

Download

memory/1900-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1900-56-0x0000000000180000-0x00000000001A4000-memory.dmp

Download

memory/1900-57-0x00000000002C0000-0x00000000002E8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads