emotet | 3c543f5ec2018e71ccc6ecd4d73dfc4548e3656662b3c2ecd7769691d74d1a63

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
30-06-2022 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c543f5ec2018e71ccc6ecd4d73dfc4548e3656662b3c2ecd7769691d74d1a63.dll
Size

426KB
MD5

90be569fe29e45f309041ee6c99e71b5
SHA1

75383cfe53e0e1f36ee2c6e48cec0f9cd4c2bbdf
SHA256

3c543f5ec2018e71ccc6ecd4d73dfc4548e3656662b3c2ecd7769691d74d1a63
SHA512

029864655fdac99dac9218dc9fc584e73ac3dac487347bd686b2ad03e4eab05498a16acec40754d89be16ddb52c27a83b0b59a52422621c16e142683407faecd

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

75.188.107.174:80

75.109.111.18:80

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

136.244.110.184:8080

84.232.252.202:443

138.68.87.218:443

172.125.40.123:80

109.74.5.95:8080

61.19.246.238:443

24.179.13.119:80

46.105.131.79:8080

185.201.9.197:8080

185.94.252.104:443

74.40.205.197:443

59.21.235.119:80

139.99.158.11:443

176.111.60.55:8080

66.57.108.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

16 2612 rundll32.exe
26 2612 rundll32.exe
44 2612 rundll32.exe
58 2612 rundll32.exe
65 2612 rundll32.exe
73 2612 rundll32.exe

flow	pid	process
16	2612	rundll32.exe
26	2612	rundll32.exe
44	2612	rundll32.exe
58	2612	rundll32.exe
65	2612	rundll32.exe
73	2612	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exe

pid	process
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe
2612	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 2612	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2612	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2612	2100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c543f5ec2018e71ccc6ecd4d73dfc4548e3656662b3c2ecd7769691d74d1a63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c543f5ec2018e71ccc6ecd4d73dfc4548e3656662b3c2ecd7769691d74d1a63.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-130-0x0000000000000000-mapping.dmp

Download
memory/2612-131-0x0000000001650000-0x0000000001670000-memory.dmp

Filesize
128KB

Download