emotet | 3bc60aa1c864991f84ede75a0810ccfde9522b87497946607bcb6ba7bacebc4b

Analysis

max time kernel
145s
max time network
186s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bc60aa1c864991f84ede75a0810ccfde9522b87497946607bcb6ba7bacebc4b.dll
Size

426KB
MD5

3bf1e5f5f6497f5edf23fd60b3c8a871
SHA1

a1c7917f95ed87aa3227cbae7dd8a0f2fc43e845
SHA256

3bc60aa1c864991f84ede75a0810ccfde9522b87497946607bcb6ba7bacebc4b
SHA512

0d71e9f62341c6253a702cbf67cff9e21df59f7022fe8429bafd75d85af274e0d2425bd06f7de86e8a085711eca66b426b6b8dda93aed529fedb68abb3148b76

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

75.188.107.174:80

75.109.111.18:80

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

136.244.110.184:8080

84.232.252.202:443

138.68.87.218:443

172.125.40.123:80

109.74.5.95:8080

61.19.246.238:443

24.179.13.119:80

46.105.131.79:8080

185.201.9.197:8080

185.94.252.104:443

74.40.205.197:443

59.21.235.119:80

139.99.158.11:443

176.111.60.55:8080

66.57.108.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

4 1860 rundll32.exe
5 1860 rundll32.exe
6 1860 rundll32.exe
7 1860 rundll32.exe
8 1860 rundll32.exe
11 1860 rundll32.exe
13 1860 rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rundll32.exe

pid process

1860 rundll32.exe
1860 rundll32.exe
1860 rundll32.exe
1860 rundll32.exe
1860 rundll32.exe

flow	pid	process
4	1860	rundll32.exe
5	1860	rundll32.exe
6	1860	rundll32.exe
7	1860	rundll32.exe
8	1860	rundll32.exe
11	1860	rundll32.exe
13	1860	rundll32.exe

pid	process
1860	rundll32.exe
1860	rundll32.exe
1860	rundll32.exe
1860	rundll32.exe
1860	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe
PID 760 wrote to memory of 1860	760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bc60aa1c864991f84ede75a0810ccfde9522b87497946607bcb6ba7bacebc4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bc60aa1c864991f84ede75a0810ccfde9522b87497946607bcb6ba7bacebc4b.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-54-0x0000000000000000-mapping.dmp

Download
memory/1860-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1860-56-0x0000000000360000-0x0000000000380000-memory.dmp

Filesize
128KB

Download