emotet | d176476e271b638a679d876e06527207ee5e7fcf91df88bc707eabd2046e455b

General

Target

d176476e271b638a679d876e06527207ee5e7fcf91df88bc707eabd2046e455b.dll
Size

265KB
MD5

623c56e06cc4a7009acebc9202d57c7b
SHA1

c8716d220181631696b4cde1a354add8c6811c9e
SHA256

d176476e271b638a679d876e06527207ee5e7fcf91df88bc707eabd2046e455b
SHA512

374785034a2b9931abdead111b7a2c5937781be0042a04e82a8dcaafdd1c0e00f392de7c3dc620e100319b5c93bdd73d9c2b13281d7617d08fe8ccb8484c5469

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

97.120.3.198:80

70.180.33.202:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

172.104.97.173:8080

41.185.28.84:8080

120.150.218.241:443

217.20.166.178:7080

67.10.155.92:80

188.219.31.12:80

120.150.60.189:80

108.21.72.56:443

186.74.215.34:80

144.217.7.207:7080

152.170.205.73:80

49.205.182.134:80

187.161.206.24:80

95.213.236.64:8080

74.40.205.197:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet3 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2612-134-0x0000000002D10000-0x0000000002D2F000-memory.dmp	Emotet3
behavioral2/memory/4936-138-0x00000000024A0000-0x00000000024BF000-memory.dmp	Emotet3

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

32 4936 rundll32.exe
40 4936 rundll32.exe
41 4936 rundll32.exe
44 4936 rundll32.exe
45 4936 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4936 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Mkqz\hcbaljv.tzv rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
32	4936	rundll32.exe
40	4936	rundll32.exe
41	4936	rundll32.exe
44	4936	rundll32.exe
45	4936	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Mkqz\hcbaljv.tzv	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

rundll32.exe

pid	process
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2612 rundll32.exe

pid	process
2612	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2484 wrote to memory of 2612	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 2612	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 2612	2484	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 4936	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 4936	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 4936	2612	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d176476e271b638a679d876e06527207ee5e7fcf91df88bc707eabd2046e455b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d176476e271b638a679d876e06527207ee5e7fcf91df88bc707eabd2046e455b.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mkqz\hcbaljv.tzv",RunDLL
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Mkqz\hcbaljv.tzv

MD5
623c56e06cc4a7009acebc9202d57c7b

SHA1
c8716d220181631696b4cde1a354add8c6811c9e

SHA256
d176476e271b638a679d876e06527207ee5e7fcf91df88bc707eabd2046e455b

SHA512
374785034a2b9931abdead111b7a2c5937781be0042a04e82a8dcaafdd1c0e00f392de7c3dc620e100319b5c93bdd73d9c2b13281d7617d08fe8ccb8484c5469

Download Submit
memory/2612-134-0x0000000002D10000-0x0000000002D2F000-memory.dmp

Filesize
124KB

Download
memory/4936-138-0x00000000024A0000-0x00000000024BF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads