emotet | c6051675a5f2b96e4f4ab960e132825859c7039e751dfcf4cc09f45d9d1c03e7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02/06/2022, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HEUR-Trojan-Banker.Win32.RTM.dll
Size 340KB
Sample220602-pnhadafhf6
SHA256 c6051675a5f2b96e4f4ab960e132825859c7039e751dfcf4cc09f45d9d1c03e7
MD5 fb191e5f0dd5abab524a45dbef0c6edb
SHA1 a5ba9371fc6851d319b959bca1e0dcc0a0b373f2
SHA512 96651346d423dc050b27e249ccf92b9109fff3f31918ab56a48b11685bd4c0d717ed52d037f656f9085fa783d68ca6609bcf8bffdc01ecf90e8d8243967a184f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

8.221.33.0:0
0.120.0.0:0
36.164.141.76:65400
16.102.59.77:34319
129.72.0.0:2284
172.137.72.0:36
172.141.72.0:36
102.139.77.0:19744
0.133.133.15:0
1.32.36.180:0
0.1.40.36:18432
139.76.164.243:9380
153.232.0.0:65529
24.36.148.139:1
255.65.34.139:19668
0.1.56.36:59392
140.139.255.255:10276
36.156.139.0:300
36.188.139.72:288
36.148.139.72:272
72.230.137.72:57089
217.41.72.222:61416
172.139.72.255:36
196.129.72.0:264
248.90.232.195:65535
76.255.255.255:44173
77.0.0.1:11321
255.255.105.133:18943
255.96.233.36:65535
204.204.204.204:52428
52.139.76.101:10277
182.139.77.0:0
36.164.141.76:65144
2.32.36.180:0
0.2.40.36:18432
153.232.0.0:65528
24.36.148.139:2
0.2.56.36:59392
36.156.139.0:556
36.188.139.72:544
36.148.139.72:528
196.129.72.0:520
247.90.232.195:65535
77.0.0.2:11321
36.164.141.76:64632
4.32.36.180:0
0.4.40.36:18432
153.232.0.0:65527
24.36.148.139:4
0.4.56.36:59392
36.156.139.0:1068
36.188.139.72:1056
36.148.139.72:1040
196.129.72.0:1032
246.90.232.195:65535
77.0.0.4:11321
36.164.141.76:63608
8.32.36.180:0
0.8.40.36:18432
153.232.0.0:65526
24.36.148.139:8
0.8.56.36:59392
36.156.139.0:2092
36.188.139.72:2080
36.148.139.72:2064
196.129.72.0:2056
245.90.232.195:65535
77.0.0.8:11321
73.228.137.73:60545
130.15.0.0:169
16.32.36.180:0
0.16.40.36:18432
145.232.0.0:65525
24.36.148.139:16
0.16.56.36:59392
36.156.139.0:4140
36.188.139.72:4128
36.148.139.72:4112
217.41.72.222:59368
196.129.72.0:4104
244.82.232.195:65535
77.0.0.16:11321
32.32.36.180:0
0.32.40.36:18432
145.232.0.0:65524
24.36.148.139:32
0.32.56.36:59392
36.156.139.0:8236
36.188.139.72:8224
36.148.139.72:8208
196.129.72.0:8200
243.82.232.195:65535
77.0.0.32:11321
64.32.36.180:0
0.64.40.36:18432
145.232.0.0:65523
24.36.148.139:64
0.64.56.36:59392
36.156.139.0:16428
36.188.139.72:16416
36.148.139.72:16400
196.129.72.0:16392
242.82.232.195:65535
77.0.0.64:11321
128.32.36.180:0
0.128.40.36:18432
145.232.0.0:65522
24.36.148.139:128
0.128.56.36:59392
36.156.139.0:32812
36.188.139.72:32800
36.148.139.72:32784
196.129.72.0:32776
241.82.232.195:65535
77.0.0.128:11321
0.32.36.180:1
1.0.40.36:18432
145.232.0.1:65521
24.36.148.139:256
1.0.56.36:59392
36.156.139.0:44
36.188.139.72:32
36.148.139.72:16
196.129.72.0:8
240.82.232.195:65535
77.0.1.0:11321
130.15.0.1:169
0.32.36.180:2
2.0.40.36:18432
145.232.0.2:65520
24.36.148.139:512
2.0.56.36:59392
239.82.232.195:65535
77.0.2.0:11321
130.15.0.3:169
0.32.36.180:4
4.0.40.36:18432
145.232.0.4:65519
24.36.148.139:1024
4.0.56.36:59392
238.82.232.195:65535
77.0.4.0:11321
130.15.0.7:169
0.32.36.180:8
8.0.40.36:18432
145.232.0.8:65518
24.36.148.139:2048
8.0.56.36:59392
237.82.232.195:65535
77.0.8.0:11321
130.15.0.15:169
0.32.36.180:16
16.0.40.36:18432
145.232.0.16:65517
24.36.148.139:4096
16.0.56.36:59392
236.82.232.195:65535
77.0.16.0:11321
130.15.0.31:169
0.32.36.180:32
32.0.40.36:18432
145.232.0.32:65516
24.36.148.139:8192
32.0.56.36:59392
235.82.232.195:65535
77.0.32.0:11321
130.15.0.63:169
0.32.36.180:64
64.0.40.36:18432
145.232.0.64:65515
24.36.148.139:16384
64.0.56.36:59392
234.82.232.195:65535
77.0.64.0:11321
130.15.0.127:169
0.32.36.180:128
128.0.40.36:18432
145.232.0.128:65514
24.36.148.139:32768
128.0.56.36:59392
233.82.232.195:65535
77.0.128.0:11321
1.112.144.139:0
0.1.120.136:19456
0.0.1.128:35144
137.72.215.137:18632
232.206.137.76:952
36.84.139.72:18528
0.0.1.120:35660
15.0.0.1:17439
0.249.129.72:1
0.3.41.134:16640
0.0.4.0:1
144.138.139.72:1
1.136.130.139:0
0.134.15.201:3
0.1.0.199:0
0.1.184.130:18432
0.0.1.112:35656
72.0.0.1:47755
15.190.0.0:0
0.0.13.132:35656
72.0.26.204:17547
184.184.139.72:1
0.0.1.1:441
228.66.232.0:65535
72.96.36.84:33419
141.72.0.0:6298
0.19.185.0:0
0.7.190.207:0
0.13.59.232:18432
0.26.204.132:35656
152.139.72.96:440
225.232.255.49:65511
112.36.84.139:34120
68.139.76.36:16420
0.255.255.248:32512
73.5.72.141:57793
0.0.0.1:4587
235.201.49.69:19466
201.49.64.36:12613
73.71.116.201:49801
1.73.4.248:19906
139.72.56.125:9284
182.15.195.137:9292
255.255.238.132:35656
92.139.72.96:28708
72.64.36.76:48267
232.0.0.0:57736
36.108.139.72:18512
139.72.195.88:9284
0.0.0.1:35144
55.36.116.182:443
235.66.232.0:65535
72.96.36.68:37003
139.76.0.0:18434
250.129.72.16:257
1.167.130.15:0
72.72.36.68:45195
139.76.0.0:9292
64.36.84.139:51505
141.72.195.88:330
56.142.15.202:1
73.24.88.139:64387
15.69.228.25:11446
77.168.60.141:32653
79.63.183.15:11405
0.109.183.15:35144
211.73.217.137:19941
16.104.11.76:35148
24.88.139.76:36175
24.96.137.76:33609
137.77.168.114:18924
104.137.76.48:20240
91.141.77.31:19664
78.141.72.24:26118
0.0.0.132:0
248.249.129.72:0
0.0.234.135:18432
0.217.135.15:0
255.255.8.158:18943
222.33.76.63:35140
236.193.73.32:26144
72.36.48.100:63873
9.125.0.0:35144
255.255.61.233:37119
0.1.208.184:0
36.84.137.72:18488
32.88.141.72:35656
24.82.139.72:63679
240.137.72.0:54015
72.96.36.68:39049
61.131.0.0:14655
72.9.117.0:34953
12.235.0.0:36168
232.0.0.1:6536
36.84.139.72:19512
139.76.72.36:9292
64.36.84.139:33608
0.0.0.1:1909
255.254.197.233:18687
131.72.80.36:22724
1.104.176.137:0
4.0.152.183:0
4.2.136.183:0
255.232.27.232:18687
137.232.240.137:61469
0.0.0.248:7951
240.28.251.232:47615
49.232.0.0:61469
28.170.232.192:65520
240.28.155.232:37119
136.8.36.68:9308
24.36.76.137:35144
116.137.72.32:10276
239.245.123.232:18687
182.15.8.36:9308
24.36.76.139:35656
116.139.72.32:10276
255.251.187.233:52479
24.236.131.72:35144
108.141.72.16:4132
72.32.36.68:31881
0.132.31.15:0
0.248.129.73:1
235.201.49.29:3850
151.4.255.8:65352
241.127.203.57:35656
196.131.72.16:49944
76.0.0.1:49801
144.255.240.28:52428
16.102.59.73:34319
131.72.0.0:10476
72.32.36.108:27789
1.5.141.72:806
0.0.1.30:35144
255.238.124.84:35144
5.141.72.24:58568
234.195.35.232:18687
0.1.30.8:18432
0.1.30.16:33536
0.0.32.55:3189
72.24.36.84:4233
137.72.13.235:18631
241.232.24.36:61463
201.49.16.139:5867
137.102.138.60:18975
91.141.72.138:26114
1.74.141.65:33126
152.131.15.1:0
0.144.249.129:2675
0.8.190.48:0
0.249.129.102:29441
0.1.0.153:48640
32.235.0.0:7951
24.249.129.102:29441
255.255.0.153:48895
8.235.0.0:22925
0.0.0.8:32397
255.128.64.223:17696
201.183.15.68:35137
68.227.211.249:49953
8.235.193.102:46863
218.117.5.141:5
64.24.28.182:46607
7.60.182.15:59329
128.31.15.251:0
30.249.129.73:1
255.255.73.130:60415
32.36.108.139:33608
200.137.76.195:7865
26.154.232.0:65520
255.239.243.148:45033
204.204.204.255:52428
161.5.141.72:804
0.0.0.30:35144
255.238.122.244:35144
5.141.72.24:58216
234.193.195.232:18687
0.0.30.8:18432
0.0.30.16:33536
0.0.32.54:3189
72.24.36.76:2185
113.232.24.36:61462
210.49.8.139:12779
137.72.145.28:49622
8.234.193.102:46863
217.141.5.141:5
102.56.60.182:15241
141.72.177.28:603
72.0.5.3:22157
124.30.250.131:18633
131.72.32.36:10436
255.239.242.196:7951
255.255.59.233:52479
49.40.36.92:12754
194.255.72.7:7951
126.209.57.72:35627
237.116.255.133:35660
76.8.139.76:49721
77.255.99.72:1165
69.2.64.141:46863
72.248.175.15:65025
72.240.137.72:27787
24.196.131.72:18627
232.193.137.76:6456
204.204.204.144:52428
36.164.141.76:64248
129.72.0.0:35052
172.137.72.0:32804
172.141.72.0:32804
156.137.72.0:38948
16.254.131.0:36111
141.68.0.0:321
199.57.76.192:33295
99.72.0.0:19665
4.54.131.15:0
65.102.211.12:455
211.20.141.72:36168
255.255.2.199:32767
127.214.57.255:35074
64.36.124.141:7951
36.108.137.72:18672
46.232.240.36:61467
72.0.109.139:48269
17.232.240.36:61466
190.0.109.139:1
198.255.6.235:7951
140.15.242.57:143
1.248.131.73:34319
123.139.0.0:18700
147.134.15.2:3
139.68.206.99:5203
4.123.3.251:33609
3.111.131.15:0
141.78.137.36:42092
0.0.69.199:0
68.164.108.141:3909
116.137.66.0:16548
70.68.164.92:21641
164.124.137.66:19532
6.225.193.73:36174
0.0.1.128:51009
0.0.0.2:7951
15.1.254.131:29061
68.199.66.255:19620
99.233.127.255:65535
60.141.242.99:36105
16.254.131.72:33551
137.72.0.0:9348
137.76.0.0:9284
48.36.116.137:35144
0.0.5.152:35144
0.0.5.160:21641
182.12.141.76:35138
76.215.137.80:51811
16.249.131.73:33551
141.79.0.0:35092
65.76.148.92:64385
61.117.127.255:35654
252.129.65.72:65535
199.66.47.117:37956
255.0.0.0:19650
141.79.0.0:35084
255.76.140.68:65535
100.139.70.162:17556
69.72.148.108:56633
73.203.137.77:57793
128.12.140.141:1
70.153.60.139:27785
1.111.141.69:35143
77.205.99.77:49465
0.0.1.254:35654
76.137.70.4:18580
0.0.178.233:17920
137.77.68.148:18891
140.141.78.6:32780
106.141.68.0:19967
16.253.131.73:33551
193.73.0.0:1765
1.128.44.172:0
68.84.116.205:25737
36.84.137.76:35112
227.193.73.36:19458
76.235.137.76:55689
72.255.240.32:33931
72.0.0.5:35979
139.0.0.5:9300
152.36.156.139:5
48.36.116.139:31883
36.68.139.76:19512
139.68.40.36:9316
64.148.76.139:65345
15.102.201.99:17439
2.80.140.68:0
80.148.76.139:36165
148.92.137.70:16720
70.92.117.1:19595
116.207.57.68:16677
70.201.99.77:25603
255.76.140.100:59842
137.72.255.255:18674
180.141.72.6:32820
150.20.139.0:51769
0.0.0.159:132
99.73.1.71:47576
60.235.0.0:35140
77.255.74.141:53603
22.115.16.250:36175
148.84.139.70:3920
127.210.133.69:59871
137.76.255.255:47568
137.232.0.0:61461
72.48.136.84:49663
30.126.255.133:25416
115.16.250.131:35641
99.76.207.255:17095
217.57.72.134:55666
131.72.25.235:12480
72.0.0.0:44171
72.0.0.5:50305
72.195.0.0:51337
21.58.232.217:65520
0.16.185.208:0
72.255.240.21:1421
141.72.0.2:3869
57.250.232.0:65517
0.16.185.200:0
76.255.240.21:51337
15.0.0.0:17439
240.20.251.232:19711
0.0.16.185:59392
137.76.255.240:19656
240.20.227.232:19711
137.76.255.240:47560
201.232.0.0:61460
16.185.240.137:0
240.20.187.232:19711
2.184.255.240:0
161.232.193.137:61460
0.0.0.1:35148
255.240.20.148:35144
137.232.193.137:61460
137.72.193.137:4090
240.20.251.232:18687
0.2.15.20:36168
232.0.9.53:14664
68.137.72.144:2084
72.16.36.92:19593
36.124.137.72:35104
237.74.232.40:65519
72.8.36.68:23691
36.76.139.72:18456
116.139.32.36:10276
204.255.255.251:52428
131.72.0.0:16620
72.56.36.108:27789
36.68.137.72:18504
137.72.88.36:9308
120.36.76.137:35144
49.210.49.104:60415
15.102.194.255:17439
15.209.57.72:52622
20.139.68.0:53651
227.116.210.133:34117
210.99.77.222:35149
57.77.208.41:4035
72.0.0.1:21641
36.68.137.76:26152
41.77.22.36:19651
137.76.32.36:32920
193.41.77.0:35148
73.0.0.0:55799
193.73.3.224:16377
240.1.73.200:35148
72.141.76.48:33656
0.0.32.47:1653
9.235.120.64:35148
240.16.59.232:18687
0.9.118.148:35148
255.240.174.108:35656
84.139.72.32:6180
72.72.36.116:31883
68.183.15.68:5668
137.72.78.235:18672
139.72.88.36:9308
104.36.116.139:35660
199.137.68.120:35660
255.33.233.40:65535
72.56.36.108:50307
12.141.79.195:26268
12.141.79.1:19868
137.65.102.2:18449
1.71.141.69:35144
125.200.57.72:17581
217.247.65.240:32833
76.210.25.69:7309
76.27.183.15:9867
137.72.8.110:17611
65.199.137.69:57555
193.137.69.208:16742
183.15.69.8:19648
0.5.210.55:3911
182.15.69.2:18377
193.65.17.12:2273
221.57.77.200:33655
233.137.76.216:30696
192.137.76.255:35148
255.240.19.44:18576
137.72.8.36:9308
76.48.36.68:19593
239.235.67.232:18687
139.72.8.36:9308
76.48.36.68:19595
255.253.251.233:52479
131.72.0.0:24812
72.88.36.108:27789
36.92.137.72:35184
68.137.72.60:26660
117.0.24.120:18524
137.72.120.36:9308
28.162.5.141:3
72.0.0.1:55689
72.255.238.114:21643
32.66.199.72:287
40.66.199.72:287
45.153.61.131:32
66.137.72.6:60184
232.24.122.141:3304
72.208.137.72:19595
36.92.139.72:35696
64.139.76.60:18456
73.141.76.40:19457
1.211.130.15:0
235.210.49.69:18435
126.249.57.72:17523
219.133.69.187:7284
167.131.15.202:1
102.208.36.141:35137
208.92.137.71:18692
57.77.211.235:4042
79.0.0.1:7309
0.3.199.65:20224
91.141.77.208:16644

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
10	2004	rundll32.exe
37	2004	rundll32.exe
112	2004	rundll32.exe
173	2004	rundll32.exe
286	2004	rundll32.exe
345	2004	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2004	1616	rundll32.exe	81
PID 1616 wrote to memory of 2004	1616	rundll32.exe	81
PID 1616 wrote to memory of 2004	1616	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win32.RTM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win32.RTM.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-131-0x0000000000ED0000-0x0000000000EF0000-memory.dmp

Download

memory/2004-132-0x0000000010000000-0x000000001005B000-memory.dmp

Download

memory/2004-133-0x0000000010000000-0x000000001005B000-memory.dmp

Download