emotet | 5f1583f22f857abcaa9337f2fa5f4a5be61ad9410759788ff3b3197b4de68994

Analysis

max time kernel
141s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f1583f22f857abcaa9337f2fa5f4a5be61ad9410759788ff3b3197b4de68994.dll
Size

426KB
MD5

6c0871a8090b7d23b949cfab10d73b57
SHA1

2b9e462dbb6f4814308ef7043f76ddeee30e465f
SHA256

5f1583f22f857abcaa9337f2fa5f4a5be61ad9410759788ff3b3197b4de68994
SHA512

20326c1861a742875b4e973b7cca0853902fd93e5328692e28bcca0fb62f0a8d7729113688692c75e67e6eba92a63d4eecd97a99ab2d3e6b2abe7b3178f1aa78

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

75.188.107.174:80

75.109.111.18:80

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

136.244.110.184:8080

84.232.252.202:443

138.68.87.218:443

172.125.40.123:80

109.74.5.95:8080

61.19.246.238:443

24.179.13.119:80

46.105.131.79:8080

185.201.9.197:8080

185.94.252.104:443

74.40.205.197:443

59.21.235.119:80

139.99.158.11:443

176.111.60.55:8080

66.57.108.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 1304 rundll32.exe
5 1304 rundll32.exe
6 1304 rundll32.exe
7 1304 rundll32.exe
8 1304 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1304 rundll32.exe
1304 rundll32.exe
1304 rundll32.exe
1304 rundll32.exe

flow	pid	process
3	1304	rundll32.exe
5	1304	rundll32.exe
6	1304	rundll32.exe
7	1304	rundll32.exe
8	1304	rundll32.exe

pid	process
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe
1304	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1304	1612	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f1583f22f857abcaa9337f2fa5f4a5be61ad9410759788ff3b3197b4de68994.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f1583f22f857abcaa9337f2fa5f4a5be61ad9410759788ff3b3197b4de68994.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-54-0x0000000000000000-mapping.dmp

Download
memory/1304-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1304-56-0x0000000000280000-0x00000000002A0000-memory.dmp

Filesize
128KB

Download