emotet | 76ce8b739bc011092d72a56445d968a9da1a53f2ea595d8a5532eea0ada95b53

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26/05/2022, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TNZRPB2F2YpS.dll
Size 342KB
Sample220526-qaf1tsfebr
SHA256 5478e90e2d42676ac423516709111caf32a9eaecad52ccd36f82d1b9ba2e1ca3
MD5 15916015078aacc15bc99f543df689ca
SHA1 613c4c69f8fb1f9ce7171f7cded6e0a4de604943
SHA512 446a19359726f8d9efbd09e836d957f036f4a64da8edc811512f15b00f0981b04fe39250fa2fea0871fa39e0a8db7f3df259e02807ed71c01381023ae09e8af2
MD5 SHA1 SHA512

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

32.40.0.32:10240
40.0.32.40:32
0.32.40.0:8232
146.76.207.79:25600
146.85.207.88:25856
146.122.207.113:26112
146.3.207.10:26368
146.40.207.35:26624
146.49.207.60:26880
146.198.207.213:27136
146.239.207.238:27392
146.244.207.135:27648
146.157.207.144:27904
146.162.207.169:28160
178.172.100.69:2560
189.69.100.94:2816
189.94.100.119:3072
189.119.100.0:3328
189.8.100.25:3584
189.33.100.50:3840
189.58.100.203:4096
189.211.100.228:4352
189.228.100.253:4608
189.253.100.150:4864
189.150.100.175:5120
189.175.100.184:5376
115.21.224.117:80
162.241.204.233:8080
50.116.111.59:8080
194.4.58.192:7080
120.150.60.189:80
172.104.97.173:8080
172.105.13.66:443
62.171.142.179:8080
110.142.236.207:80
62.75.141.82:80
203.153.216.189:7080
66.57.108.14:443
87.106.139.101:8080
120.150.218.241:443
115.94.207.99:443
173.70.61.180:80
2.58.16.89:8080
24.231.88.85:80
200.116.145.225:443
74.58.215.226:80
123.176.25.234:80
188.219.31.12:80
50.245.107.73:443
110.145.101.66:443
181.165.68.127:80
47.144.21.37:80
144.217.7.207:7080
157.245.99.39:8080
75.177.207.146:80
51.89.36.180:443
98.109.133.80:80
71.72.196.159:80
74.128.121.17:80
70.92.118.112:80
109.116.245.80:80
197.211.245.21:80
172.125.40.123:80
95.9.5.93:80
118.83.154.64:443
64.207.182.168:8080
167.114.153.111:8080
190.251.200.206:80
220.245.198.194:80
46.105.131.79:8080
49.205.182.134:80
181.171.209.241:443
139.162.60.124:8080
78.24.219.147:8080
121.124.124.40:7080
24.69.65.8:8080
190.103.228.24:80
174.118.202.24:443
185.201.9.197:8080
202.134.4.216:8080
94.23.237.171:443
70.183.211.3:80
134.209.144.106:443
41.185.28.84:8080
136.244.110.184:8080
37.187.72.193:8080
79.137.83.50:443
85.105.205.77:8080
24.178.90.49:80
89.106.251.163:80
59.21.235.119:80
95.213.236.64:8080
161.0.153.60:80
78.189.148.42:80
217.20.166.178:7080
180.222.161.85:80
75.113.193.72:80
186.74.215.34:80
202.134.4.211:8080
5.2.212.254:80
104.131.11.150:443
78.182.254.231:80
119.59.116.21:8080
78.188.225.105:80
176.111.60.55:8080
50.91.114.38:80
185.94.252.104:443
110.145.11.73:80
188.165.214.98:8080
24.179.13.119:80
172.86.188.251:8080
139.59.60.244:8080
139.99.158.11:443
138.68.87.218:443
69.49.88.46:80
85.105.111.166:80
74.40.205.197:443
86.98.21.56:443
37.139.21.175:8080
190.240.194.77:443
168.235.67.138:7080
187.161.206.24:80
194.190.67.75:80
74.208.45.104:8080
61.19.246.238:443
75.109.111.18:80
24.164.79.147:8080
5.39.91.110:7080
93.146.48.84:80
109.74.5.95:8080
89.216.122.92:80
0.0.0.38:0
0.0.0.6:0

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
11	364	rundll32.exe
25	364	rundll32.exe
28	364	rundll32.exe
29	364	rundll32.exe
30	364	rundll32.exe
31	364	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2972	rundll32.exe
364	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Wyihtogcwhw\svtfowvrli.scb	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4780	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4780	2712	rundll32.exe	80
PID 2712 wrote to memory of 4780	2712	rundll32.exe	80
PID 2712 wrote to memory of 4780	2712	rundll32.exe	80
PID 4780 wrote to memory of 2972	4780	rundll32.exe	81
PID 4780 wrote to memory of 2972	4780	rundll32.exe	81
PID 4780 wrote to memory of 2972	4780	rundll32.exe	81
PID 2972 wrote to memory of 364	2972	rundll32.exe	82
PID 2972 wrote to memory of 364	2972	rundll32.exe	82
PID 2972 wrote to memory of 364	2972	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TNZRPB2F2YpS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TNZRPB2F2YpS.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wyihtogcwhw\svtfowvrli.scb",zFYFx
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Wyihtogcwhw\svtfowvrli.scb",#1
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svtfowvrli.scb

Path C:\Windows\SysWOW64\Wyihtogcwhw\svtfowvrli.scb
Size 342KB
SHA256 5478e90e2d42676ac423516709111caf32a9eaecad52ccd36f82d1b9ba2e1ca3
MD5 15916015078aacc15bc99f543df689ca
SHA1 613c4c69f8fb1f9ce7171f7cded6e0a4de604943
SHA512 446a19359726f8d9efbd09e836d957f036f4a64da8edc811512f15b00f0981b04fe39250fa2fea0871fa39e0a8db7f3df259e02807ed71c01381023ae09e8af2
SSDEEP 3072:6/GZgCBD0JqvjYGRKbGUUtvAMdg6Ygpr7kL2LWsFzMFruztyr1Bg:2GSkDgqvPRKib6+g8rtLWFcEpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

svtfowvrli.scb

Path C:\Windows\SysWOW64\Wyihtogcwhw\svtfowvrli.scb
Size 342KB
SHA256 5478e90e2d42676ac423516709111caf32a9eaecad52ccd36f82d1b9ba2e1ca3
MD5 15916015078aacc15bc99f543df689ca
SHA1 613c4c69f8fb1f9ce7171f7cded6e0a4de604943
SHA512 446a19359726f8d9efbd09e836d957f036f4a64da8edc811512f15b00f0981b04fe39250fa2fea0871fa39e0a8db7f3df259e02807ed71c01381023ae09e8af2
SSDEEP 3072:6/GZgCBD0JqvjYGRKbGUUtvAMdg6Ygpr7kL2LWsFzMFruztyr1Bg:2GSkDgqvPRKib6+g8rtLWFcEpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-138-0x0000000010000000-0x000000001005B000-memory.dmp

Download

memory/2972-136-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/4780-131-0x0000000001490000-0x00000000014B0000-memory.dmp

Download

memory/4780-132-0x0000000010000000-0x000000001005B000-memory.dmp

Download