emotet | 606b93f8ca5d6f3181a1bb1f4e38a94b667d7cbdaf9f9dc6e9442e6f342b1390

Analysis

max time kernel
4294195s
max time network
148s
platform
windows7_x64
resource
win7-20220311-en
submitted
19-03-2022 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

606b93f8ca5d6f3181a1bb1f4e38a94b667d7cbdaf9f9dc6e9442e6f342b1390.dll
Size

322KB
MD5

945c9a2026124147d72a75df8c104953
SHA1

89ae668767172a5bded07904105fe80ce6820781
SHA256

606b93f8ca5d6f3181a1bb1f4e38a94b667d7cbdaf9f9dc6e9442e6f342b1390
SHA512

ad406110d3cd2af76f7e01b49c08b8b4a2213fa07e6a307af0a043fd0ffd65c76c56250c6e91559ac0068d32bd95d1b9fc845ae90f5c8cc4b56c5bae005f7449

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

197.87.160.216:80

78.188.225.105:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

188.219.31.12:80

157.245.99.39:8080

172.125.40.123:80

62.30.7.67:443

120.150.60.189:80

109.74.5.95:8080

67.10.155.92:80

67.170.250.203:443

2.58.16.89:8080

186.74.215.34:80

202.141.243.254:443

118.83.154.64:443

172.86.188.251:8080

37.187.72.193:8080

87.106.139.101:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

4 1944 rundll32.exe
5 1944 rundll32.exe
6 1944 rundll32.exe
7 1944 rundll32.exe
8 1944 rundll32.exe
9 1944 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1944 rundll32.exe
1944 rundll32.exe
1944 rundll32.exe
1944 rundll32.exe

flow	pid	process
4	1944	rundll32.exe
5	1944	rundll32.exe
6	1944	rundll32.exe
7	1944	rundll32.exe
8	1944	rundll32.exe
9	1944	rundll32.exe

pid	process
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1944	1956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\606b93f8ca5d6f3181a1bb1f4e38a94b667d7cbdaf9f9dc6e9442e6f342b1390.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\606b93f8ca5d6f3181a1bb1f4e38a94b667d7cbdaf9f9dc6e9442e6f342b1390.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x00000000767A1000-0x00000000767A3000-memory.dmp

Filesize
8KB

Download
memory/1944-55-0x00000000006A0000-0x00000000006BF000-memory.dmp

Filesize
124KB

Download