Overview

overview

10

Static

static

1

P44G.dll

windows7-x64

10

P44G.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    P44G.dll
  • Size 330KB
  • Sample230204-mrzbysdb27
  • SHA256 2b19492ecb4811ab74ba978cc641c0d6e957c016e6f690a93ecceea9301ac1f9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
emotetepoch3bankerpersistencetrojan

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 139.72.1.139:4160

  • 0.22.10.252:35656

  • 1.139.72.72:35656

  • 10.234.21.255:22

  • 0.1.80.141:18432

  • 3.86.211.232:18432

  • 0.2.176.36:18432

  • 0.0.2.96:24385

  • 92.65.93.65:24159

  • 204.204.204.204:52428

  • 36.92.137.72:18440

  • 72.87.16.36:60547

  • 139.72.218.139:17913

  • 133.69.51.117:29888

  • 203.188.13.56:31

  • 31.215.179.53:29696

  • 5.139.55.137:39496

  • 192.51.3.137:35656

  • 116.139.72.48:14372

  • 195.95.32.196:59596

rsa_pubkey.plain

Targets

    • Target
      P44G.dll
    • Size 330KB
    • SHA256 2b19492ecb4811ab74ba978cc641c0d6e957c016e6f690a93ecceea9301ac1f9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    emotetepoch3bankertrojanpersistence

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks