emotet | 19b793d9dacad5eac793ee369687ec3979db6848cf3b471a53f861ce8f041bac

General

Target

04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll
Size

252KB
MD5

d0992fffda8fd4acbe44c1b07dd0b4dd
SHA1

bbaca5532b18e7c8506a7d4be008a6e4c897e43e
SHA256

04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc
SHA512

0b715ae50791d1c30df8810948cfa7d99ccb7f092510eb5aa3e61a218a1b96052b2c6ba61fa5ce1509aa55bb2dc7c722fc52062854256a5ea48e59b3aff184f4
SSDEEP

6144:9ks3h7Usv9KgNXyyPSkDTQhJh1WTB5TCa:9kMgwWyqkDT0WTfWa

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

81.0.236.93:443

94.177.248.64:443

66.42.55.5:7080

103.8.26.103:8080

185.184.25.237:8080

45.76.176.10:8080

188.93.125.116:8080

103.8.26.102:8080

178.79.147.66:8080

58.227.42.236:80

45.118.135.203:7080

103.75.201.2:443

195.154.133.20:443

45.142.114.231:8080

212.237.5.209:443

207.38.84.195:8080

104.251.214.46:8080

138.185.72.26:8080

51.68.175.8:8080

210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	process
9	804	rundll32.exe
11	804	rundll32.exe
20	804	rundll32.exe
25	804	rundll32.exe
27	804	rundll32.exe
29	804	rundll32.exe
30	804	rundll32.exe
31	804	rundll32.exe

Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

3116 rundll32.exe
804 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Ebvmcxgtnhiavda\twqhccqwutqji.oor rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

804 rundll32.exe
804 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2192 rundll32.exe

pid	process
3116	rundll32.exe
804	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ebvmcxgtnhiavda\twqhccqwutqji.oor	rundll32.exe

pid	process
804	rundll32.exe
804	rundll32.exe

pid	process
2192	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 4676 wrote to memory of 4608	4676	rundll32.exe	rundll32.exe
PID 4676 wrote to memory of 4608	4676	rundll32.exe	rundll32.exe
PID 4676 wrote to memory of 4608	4676	rundll32.exe	rundll32.exe
PID 4608 wrote to memory of 2192	4608	rundll32.exe	rundll32.exe
PID 4608 wrote to memory of 2192	4608	rundll32.exe	rundll32.exe
PID 4608 wrote to memory of 2192	4608	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 3116	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 3116	2192	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 3116	2192	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 804	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 804	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 804	3116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc.dll",Control_RunDLL
3⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ebvmcxgtnhiavda\twqhccqwutqji.oor",kESzvHJjSdWtzZB
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ebvmcxgtnhiavda\twqhccqwutqji.oor",Control_RunDLL
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ebvmcxgtnhiavda\twqhccqwutqji.oor
Filesize
252KB

MD5
d0992fffda8fd4acbe44c1b07dd0b4dd

SHA1
bbaca5532b18e7c8506a7d4be008a6e4c897e43e

SHA256
04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc

SHA512
0b715ae50791d1c30df8810948cfa7d99ccb7f092510eb5aa3e61a218a1b96052b2c6ba61fa5ce1509aa55bb2dc7c722fc52062854256a5ea48e59b3aff184f4

Download Submit
C:\Windows\SysWOW64\Ebvmcxgtnhiavda\twqhccqwutqji.oor
Filesize
252KB

MD5
d0992fffda8fd4acbe44c1b07dd0b4dd

SHA1
bbaca5532b18e7c8506a7d4be008a6e4c897e43e

SHA256
04127316b9d7776ed0054f2a1d0a69e9475ece1f5790d95cf9d46a291026d9dc

SHA512
0b715ae50791d1c30df8810948cfa7d99ccb7f092510eb5aa3e61a218a1b96052b2c6ba61fa5ce1509aa55bb2dc7c722fc52062854256a5ea48e59b3aff184f4

Download Submit
memory/804-139-0x0000000000000000-mapping.dmp

Download
memory/804-141-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/804-142-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2192-133-0x0000000000000000-mapping.dmp

Download
memory/2192-135-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2192-137-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/3116-136-0x0000000000000000-mapping.dmp

Download
memory/4608-132-0x0000000000000000-mapping.dmp

Download
memory/4608-134-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing