emotet | 7123a5780edfa064c8227370f8d0b40a4d5b9845f8f0583fcc903671dfac2cdb

Analysis

max time kernel
152s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7123a5780edfa064c8227370f8d0b40a4d5b9845f8f0583fcc903671dfac2cdb.dll
Size

187KB
MD5

db3510f8154d0cf06a2497405e85c67b
SHA1

230948e9d29006ebe8986278c106495f939067b3
SHA256

7123a5780edfa064c8227370f8d0b40a4d5b9845f8f0583fcc903671dfac2cdb
SHA512

8e4785391741e00e0381860c451e94822475c00adefe8fb5c016b02b6ccb35a5d7c4e96d9f293c8e2f07f09e9396783e3ab3cb9250c85bf6e08547909c9cadc5

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

5.2.136.90:80

186.147.237.3:8080

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

187.162.248.237:80

1.226.84.243:8080

110.39.160.38:443

5.196.35.138:7080

59.148.253.194:8080

45.16.226.117:443

95.76.153.115:80

181.61.182.143:80

46.43.2.95:8080

188.135.15.49:80

81.215.230.173:443

45.4.32.50:80

81.214.253.80:443

94.176.234.118:443

212.71.237.140:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

3 3100 rundll32.exe
23 3100 rundll32.exe
35 3100 rundll32.exe
41 3100 rundll32.exe
47 3100 rundll32.exe

flow	pid	process
3	3100	rundll32.exe
23	3100	rundll32.exe
35	3100	rundll32.exe
41	3100	rundll32.exe
47	3100	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

rundll32.exe

pid	process
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe
3100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2664 wrote to memory of 3100	2664	rundll32.exe	rundll32.exe
PID 2664 wrote to memory of 3100	2664	rundll32.exe	rundll32.exe
PID 2664 wrote to memory of 3100	2664	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7123a5780edfa064c8227370f8d0b40a4d5b9845f8f0583fcc903671dfac2cdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7123a5780edfa064c8227370f8d0b40a4d5b9845f8f0583fcc903671dfac2cdb.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-130-0x0000000000000000-mapping.dmp

Download
memory/3100-131-0x0000000002450000-0x000000000246F000-memory.dmp

Filesize
124KB

Download