emotet | af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
06-03-2022 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f.dll
Size

124KB
MD5

d3991e339e53faff49e4a611161314fc
SHA1

a76ee4a4a372d979e4d5203381e81ac8db7bcb86
SHA256

af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f
SHA512

c4aa45e8d7a2e34a683616b762a766cb62f85279d35a0bd007579c5e50dcbceb44eed1d9bea4974a0a3f1754186c509be110c5f0146562fa6a002cc37f0be484

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

200.116.145.225:443

96.126.101.6:8080

5.196.108.185:8080

167.114.153.111:8080

194.187.133.160:443

98.174.164.72:80

103.86.49.11:8080

78.24.219.147:8080

50.245.107.73:443

110.145.77.103:80

94.200.114.161:80

61.19.246.238:443

194.4.58.192:7080

209.54.13.14:80

102.182.93.220:80

46.105.131.79:8080

142.112.10.95:20

186.70.56.94:443

203.153.216.189:7080

49.50.209.131:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 1 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral2/memory/3660-130-0x0000000000400000-0x0000000000421000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

3660 rundll32.exe
3660 rundll32.exe
3660 rundll32.exe
3660 rundll32.exe

pid	process
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe
3660	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3876 wrote to memory of 3660	3876	rundll32.exe	rundll32.exe
PID 3876 wrote to memory of 3660	3876	rundll32.exe	rundll32.exe
PID 3876 wrote to memory of 3660	3876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3660-130-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download