emotet | ef4c4b46735bde86b0dd0a9d8f1d4fb2518359672a0b1450b75e3f0a8cb5b39e

Analysis

max time kernel
147s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
30-06-2022 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef4c4b46735bde86b0dd0a9d8f1d4fb2518359672a0b1450b75e3f0a8cb5b39e.dll
Size

426KB
MD5

90a2066411656b3be186f7d551e17350
SHA1

24b3fa30158c0f0e6c57c64abe9f74dbd0b741d1
SHA256

ef4c4b46735bde86b0dd0a9d8f1d4fb2518359672a0b1450b75e3f0a8cb5b39e
SHA512

79d1873d2247e03a4cf3ee964afd1038eb8229609dbcace69ac62ff866ccbc5004d7c464b6b9e038e25807cf518c6cad20d0b7895dc6a81d18b1ca5aa499e79d

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

75.188.107.174:80

75.109.111.18:80

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

136.244.110.184:8080

84.232.252.202:443

138.68.87.218:443

172.125.40.123:80

109.74.5.95:8080

61.19.246.238:443

24.179.13.119:80

46.105.131.79:8080

185.201.9.197:8080

185.94.252.104:443

74.40.205.197:443

59.21.235.119:80

139.99.158.11:443

176.111.60.55:8080

66.57.108.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

7 3380 rundll32.exe
21 3380 rundll32.exe
38 3380 rundll32.exe
44 3380 rundll32.exe
50 3380 rundll32.exe

flow	pid	process
7	3380	rundll32.exe
21	3380	rundll32.exe
38	3380	rundll32.exe
44	3380	rundll32.exe
50	3380	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

rundll32.exe

pid	process
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3132 wrote to memory of 3380	3132	rundll32.exe	rundll32.exe
PID 3132 wrote to memory of 3380	3132	rundll32.exe	rundll32.exe
PID 3132 wrote to memory of 3380	3132	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef4c4b46735bde86b0dd0a9d8f1d4fb2518359672a0b1450b75e3f0a8cb5b39e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3132

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef4c4b46735bde86b0dd0a9d8f1d4fb2518359672a0b1450b75e3f0a8cb5b39e.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-130-0x0000000000000000-mapping.dmp

Download
memory/3380-131-0x0000000001330000-0x0000000001350000-memory.dmp

Filesize
128KB

Download