emotet | bab657c6e716d12f95f76eb2b299c4498dbe1c102b0440b1c2e6eb16b2db7483

Analysis

max time kernel
143s
max time network
172s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bab657c6e716d12f95f76eb2b299c4498dbe1c102b0440b1c2e6eb16b2db7483.dll
Size

187KB
MD5

579cc464b4f8006bcf7ab5b78b88b0a7
SHA1

bf3cf6a364d769311ecaf8a6629e1bbc3fccd174
SHA256

bab657c6e716d12f95f76eb2b299c4498dbe1c102b0440b1c2e6eb16b2db7483
SHA512

51879b48b0c43b91db61fa0a0445db8149c82e1e28845a79ac99a209597d838eee8005c1c55d9e4a0da10cc4fc102f8b451a41cf156755fcd301422fdf2e68da

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

5.2.136.90:80

186.147.237.3:8080

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

187.162.248.237:80

1.226.84.243:8080

110.39.160.38:443

5.196.35.138:7080

59.148.253.194:8080

45.16.226.117:443

95.76.153.115:80

181.61.182.143:80

46.43.2.95:8080

188.135.15.49:80

81.215.230.173:443

45.4.32.50:80

81.214.253.80:443

94.176.234.118:443

212.71.237.140:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

4 832 rundll32.exe
5 832 rundll32.exe
6 832 rundll32.exe
7 832 rundll32.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

rundll32.exe

pid process

832 rundll32.exe
832 rundll32.exe
832 rundll32.exe

flow	pid	process
4	832	rundll32.exe
5	832	rundll32.exe
6	832	rundll32.exe
7	832	rundll32.exe

pid	process
832	rundll32.exe
832	rundll32.exe
832	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 832	1812	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bab657c6e716d12f95f76eb2b299c4498dbe1c102b0440b1c2e6eb16b2db7483.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bab657c6e716d12f95f76eb2b299c4498dbe1c102b0440b1c2e6eb16b2db7483.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x0000000000000000-mapping.dmp

Download
memory/832-55-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download
memory/832-56-0x00000000001B0000-0x00000000001CF000-memory.dmp

Filesize
124KB

Download