Overview

overview

10

Static

static

tgzrnhae.dll

windows7_x64

8

tgzrnhae.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tgzrnhae
  • Size 348KB
  • Sample220421-yla8qagce5
  • SHA256 b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 181.10.46.92:80

  • 2.58.16.88:8080

  • 206.189.232.2:8080

  • 178.250.54.208:8080

  • 167.71.148.58:443

  • 202.134.4.210:7080

  • 187.162.248.237:80

  • 78.206.229.130:80

  • 85.214.26.7:8080

  • 5.196.35.138:7080

  • 1.226.84.243:8080

  • 110.39.162.2:443

  • 185.183.16.47:80

  • 152.231.89.226:80

  • 138.97.60.141:7080

  • 94.176.234.118:443

  • 46.101.58.37:8080

  • 93.146.143.191:80

  • 70.32.84.74:8080

  • 137.74.106.111:7080

rsa_pubkey.plain

Targets

    • Target
      tgzrnhae
    • Size 348KB
    • SHA256 b5abacf24ae5aa96016c09f71a78d0121fff396d6154740eab622c4751e1764f
    • MD5 SHA1 SHA512
    Score
    10/10
    emotetepoch1bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks