emotet | 6f6d6e33ae558f05aa510158ed5e167ebc9460609a92668015ace0d766bb72c4

Analysis

max time kernel
133s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a847af3c34a1f6a807a53b84e4960f4.dll
Size

432KB
MD5

6a847af3c34a1f6a807a53b84e4960f4
SHA1

cfc785dfed7294f7109ec2f19709cce5dd66c541
SHA256

6f6d6e33ae558f05aa510158ed5e167ebc9460609a92668015ace0d766bb72c4
SHA512

9b7b00809f89187f367494f3421d581ff5eb1372cc69aedf860b64fdba7979fb6fbfd0b9ddaba5de85f42f57cec8fda3fdbfca7ac8afac9333662211240d8e22
SSDEEP

12288:rkEjer16eQSqXL4m1EiOS1OrX3sBqCjM7cuJceViQjnbbyADuCgs:rk2E1kEi1asBqCM7liQjbFuO

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

24.231.88.85:80

191.112.178.60:80

50.116.111.59:8080

173.249.20.233:443

188.165.214.98:8080

74.40.205.197:443

62.75.141.82:80

2.58.16.89:8080

188.219.31.12:80

95.213.236.64:8080

72.186.136.247:443

185.201.9.197:8080

203.153.216.189:7080

202.134.4.216:8080

72.229.97.235:80

24.179.13.119:80

174.118.202.24:443

74.208.45.104:8080

51.89.36.180:443

202.141.243.254:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

3 2452 rundll32.exe
5 2452 rundll32.exe
6 2452 rundll32.exe
9 2452 rundll32.exe
10 2452 rundll32.exe
11 2452 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Epbxtxscryyc\ynibzdvmqug.hmq rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2452 rundll32.exe
2452 rundll32.exe
2452 rundll32.exe
2452 rundll32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1520 rundll32.exe

flow	pid	process
3	2452	rundll32.exe
5	2452	rundll32.exe
6	2452	rundll32.exe
9	2452	rundll32.exe
10	2452	rundll32.exe
11	2452	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Epbxtxscryyc\ynibzdvmqug.hmq	rundll32.exe

pid	process
2452	rundll32.exe
2452	rundll32.exe
2452	rundll32.exe
2452	rundll32.exe

pid	process
1520	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 2516 wrote to memory of 1520	2516	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe
PID 1520 wrote to memory of 2452	1520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a847af3c34a1f6a807a53b84e4960f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6a847af3c34a1f6a807a53b84e4960f4.dll,#1
2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Epbxtxscryyc\ynibzdvmqug.hmq",Control_RunDLL
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-0-0x0000000000200000-0x0000000000220000-memory.dmp

Filesize
128KB

Download
memory/2452-3-0x0000000000240000-0x0000000000260000-memory.dmp

Filesize
128KB

Download