emotet | f648ec43f1d2f4e58a4c932945760959aa5006229d9c43f9c94b583e88d8e01c

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
30-06-2022 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f648ec43f1d2f4e58a4c932945760959aa5006229d9c43f9c94b583e88d8e01c.dll
Size

426KB
MD5

747f8c593dc6e510845e2b0339bb79a8
SHA1

a692f478de4182c99dc27a955547cd9f99956272
SHA256

f648ec43f1d2f4e58a4c932945760959aa5006229d9c43f9c94b583e88d8e01c
SHA512

2ebc56d160a2df97005ef0951b445e9ffba40fa2f61210295439858fbcb3d11c812fa9d582a9da6c31b165e4ba89b9c519bf7176612479352523410ba6589dd3

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

75.188.107.174:80

75.109.111.18:80

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

136.244.110.184:8080

84.232.252.202:443

138.68.87.218:443

172.125.40.123:80

109.74.5.95:8080

61.19.246.238:443

24.179.13.119:80

46.105.131.79:8080

185.201.9.197:8080

185.94.252.104:443

74.40.205.197:443

59.21.235.119:80

139.99.158.11:443

176.111.60.55:8080

66.57.108.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

10 3384 rundll32.exe
22 3384 rundll32.exe
38 3384 rundll32.exe
48 3384 rundll32.exe
52 3384 rundll32.exe
53 3384 rundll32.exe

flow	pid	process
10	3384	rundll32.exe
22	3384	rundll32.exe
38	3384	rundll32.exe
48	3384	rundll32.exe
52	3384	rundll32.exe
53	3384	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exe

pid	process
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe
3384	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3292 wrote to memory of 3384	3292	rundll32.exe	rundll32.exe
PID 3292 wrote to memory of 3384	3292	rundll32.exe	rundll32.exe
PID 3292 wrote to memory of 3384	3292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f648ec43f1d2f4e58a4c932945760959aa5006229d9c43f9c94b583e88d8e01c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f648ec43f1d2f4e58a4c932945760959aa5006229d9c43f9c94b583e88d8e01c.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3384-130-0x0000000000000000-mapping.dmp

Download
memory/3384-131-0x0000000002500000-0x0000000002520000-memory.dmp

Filesize
128KB

Download