Overview

overview

10

Static

static

TNZRPB2F2YpS.dll

windows7_x64

10

TNZRPB2F2YpS.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    TNZRPB2F2YpS.bin.zip
  • Size 129KB
  • Sample220526-qaf1tsfebr
  • SHA256 76ce8b739bc011092d72a56445d968a9da1a53f2ea595d8a5532eea0ada95b53
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 115.21.224.117:80

  • 162.241.204.233:8080

  • 50.116.111.59:8080

  • 194.4.58.192:7080

  • 120.150.60.189:80

  • 172.104.97.173:8080

  • 172.105.13.66:443

  • 62.171.142.179:8080

  • 110.142.236.207:80

  • 62.75.141.82:80

  • 203.153.216.189:7080

  • 66.57.108.14:443

  • 87.106.139.101:8080

  • 120.150.218.241:443

  • 115.94.207.99:443

  • 173.70.61.180:80

  • 2.58.16.89:8080

  • 24.231.88.85:80

  • 200.116.145.225:443

  • 74.58.215.226:80

rsa_pubkey.plain

Targets

    • Target
      TNZRPB2F2YpS.bin
    • Size 342KB
    • SHA256 5478e90e2d42676ac423516709111caf32a9eaecad52ccd36f82d1b9ba2e1ca3
    • MD5 SHA1 SHA512
    Score
    10/10
    emotetepoch2bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks