emotet | caf560c0cea411fb8169aeadada517d7717d330c15b28bc95196d3584bb0e254

Analysis

max time kernel
128s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caf560c0cea411fb8169aeadada517d7717d330c15b28bc95196d3584bb0e254.dll
Size

187KB
MD5

16c353430fbac651239bc23385f6e2e2
SHA1

ca4dcc1f7ee3c2086013d618763d9b25bf925492
SHA256

caf560c0cea411fb8169aeadada517d7717d330c15b28bc95196d3584bb0e254
SHA512

6683ac5aaaafb7ff8b62edbf9f57787af4df7af7eaef20eeb4050672128199ed620b25118640551cf05bf9c5db7407213e4c242c2934319b6dd0ef7764deffb1

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

5.2.136.90:80

186.147.237.3:8080

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

187.162.248.237:80

1.226.84.243:8080

110.39.160.38:443

5.196.35.138:7080

59.148.253.194:8080

45.16.226.117:443

95.76.153.115:80

181.61.182.143:80

46.43.2.95:8080

188.135.15.49:80

81.215.230.173:443

45.4.32.50:80

81.214.253.80:443

94.176.234.118:443

212.71.237.140:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

18 3844 rundll32.exe
34 3844 rundll32.exe
39 3844 rundll32.exe
41 3844 rundll32.exe
42 3844 rundll32.exe

flow	pid	process
18	3844	rundll32.exe
34	3844	rundll32.exe
39	3844	rundll32.exe
41	3844	rundll32.exe
42	3844	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

rundll32.exe

pid	process
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe
3844	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4392 wrote to memory of 3844	4392	rundll32.exe	rundll32.exe
PID 4392 wrote to memory of 3844	4392	rundll32.exe	rundll32.exe
PID 4392 wrote to memory of 3844	4392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caf560c0cea411fb8169aeadada517d7717d330c15b28bc95196d3584bb0e254.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caf560c0cea411fb8169aeadada517d7717d330c15b28bc95196d3584bb0e254.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3844-130-0x0000000000000000-mapping.dmp

Download
memory/3844-131-0x00000000011A0000-0x00000000011BF000-memory.dmp

Filesize
124KB

Download