emotet | f225d8d7af1e649cb040f663bbfb3b54c52eda84e929464f4ba58b8aaef5e837

Analysis

max time kernel
133s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17-03-2022 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f225d8d7af1e649cb040f663bbfb3b54c52eda84e929464f4ba58b8aaef5e837.dll
Size

322KB
MD5

3030aa6121483d8dfa9a0bc801c781ad
SHA1

71fbea02170f1e90f4f5eeac914f4df3476e3b3d
SHA256

f225d8d7af1e649cb040f663bbfb3b54c52eda84e929464f4ba58b8aaef5e837
SHA512

0a621e7fd0f5be4c6f7e732f9bac06220b43a4d2661b3e9e9b43570c57c2516c28cd54fbad26af2e883dbb76ae58205afeac523478a61acf6883f72196d22ce2

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

197.87.160.216:80

78.188.225.105:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

188.219.31.12:80

157.245.99.39:8080

172.125.40.123:80

62.30.7.67:443

120.150.60.189:80

109.74.5.95:8080

67.10.155.92:80

67.170.250.203:443

2.58.16.89:8080

186.74.215.34:80

202.141.243.254:443

118.83.154.64:443

172.86.188.251:8080

37.187.72.193:8080

87.106.139.101:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet3 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2004-130-0x0000000002A40000-0x0000000002A5F000-memory.dmp	Emotet3

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

4 2004 rundll32.exe
22 2004 rundll32.exe
34 2004 rundll32.exe
36 2004 rundll32.exe
37 2004 rundll32.exe
39 2004 rundll32.exe

flow	pid	process
4	2004	rundll32.exe
22	2004	rundll32.exe
34	2004	rundll32.exe
36	2004	rundll32.exe
37	2004	rundll32.exe
39	2004	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exe

pid	process
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 2004	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2004	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2004	1852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f225d8d7af1e649cb040f663bbfb3b54c52eda84e929464f4ba58b8aaef5e837.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f225d8d7af1e649cb040f663bbfb3b54c52eda84e929464f4ba58b8aaef5e837.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-130-0x0000000002A40000-0x0000000002A5F000-memory.dmp

Filesize
124KB

Download