emotet | 7cddd51f10fca53125553bd311350abd2ccee4a53bc488544893f45194b69b53

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-02-2023 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec.dll
Size

233KB
MD5

5aefd49a03a4810e6dd2b73395deb12b
SHA1

7706a62fa35616037c6ce35d71eea6fa10cc0eac
SHA256

f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec
SHA512

2e622a4c7cc2da5a4dee64823fa42b499749fd473dee5d0e9703e08b8d4f564b57a8eb6c75eb057d02d25f81ccc851f1ab266ab68ae4c3eb8c266a8cc8bf44ff
SSDEEP

3072:KC1sUJsEIoECTFM5/A8eWLdlU8thEnYsqibnjPw+a5DIYvK8UIDoQQh3:KC1NJMoEywAkdrHEn1qibjm5DIYSX

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

184.66.18.83:80

202.187.222.40:80

167.71.148.58:443

211.215.18.93:8080

1.234.65.61:80

80.15.100.37:80

155.186.9.160:80

172.104.169.32:8080

110.39.162.2:443

12.162.84.2:8080

181.136.190.86:80

68.183.190.199:8080

191.223.36.170:80

190.45.24.210:80

81.213.175.132:80

181.120.29.49:80

82.76.111.249:443

177.23.7.151:80

95.76.153.115:80

93.148.247.169:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

3 816 rundll32.exe
5 816 rundll32.exe
6 816 rundll32.exe
9 816 rundll32.exe
10 816 rundll32.exe
13 816 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Gman\owm.ten rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

816 rundll32.exe
816 rundll32.exe
816 rundll32.exe
816 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1268 rundll32.exe

flow	pid	process
3	816	rundll32.exe
5	816	rundll32.exe
6	816	rundll32.exe
9	816	rundll32.exe
10	816	rundll32.exe
13	816	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Gman\owm.ten	rundll32.exe

pid	process
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe

pid	process
1268	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1292 wrote to memory of 1268	1292	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe
PID 1268 wrote to memory of 816	1268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f3842cd4b63be5212f9d13436938759fc5d1966bdad0cec0819f87cfbfb3adec.dll,#1
2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Gman\owm.ten",RunDLL
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-59-0x0000000000000000-mapping.dmp

Download
memory/816-61-0x0000000000260000-0x0000000000282000-memory.dmp

Filesize
136KB

Download
memory/1268-54-0x0000000000000000-mapping.dmp

Download
memory/1268-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1268-56-0x0000000000200000-0x0000000000222000-memory.dmp

Filesize
136KB

Download