emotet | 035ce025ac393d38b79829b53f6390870f7ab350f2286c661bcb2fcb64f9fd67

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
035ce025ac393d38b79829b53f6390870f7ab350f2286c661bcb2fcb64f9fd67.dll
Size 252KB
Sample241113-vvhsdazjar
SHA256 035ce025ac393d38b79829b53f6390870f7ab350f2286c661bcb2fcb64f9fd67
MD5 c29901bfe5cb9464fc4cba2a89a4ed08
SHA1 ffd7e91823b3e048736299f5f8347d667724187d
SHA512 f90bdc4222a086919eaeb5482cfdd66d5da4097b7c7378b73b767cad3c264f5a0e7e99a7af9b9582cc959e8074be8d0a062054a9fd00c78d5d07fa2c6ec0ba06
SSDEEP 6144:oLrMTBgGfnjcFcnwJhH4jEeyIdChWTBi3E:oLcBHZwHH4jEeAWTwE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch4 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Blocklisted process makes network request 9 IoCs

flow	pid	Process
15	2208	rundll32.exe
23	2208	rundll32.exe
37	2208	rundll32.exe
41	2208	rundll32.exe
42	2208	rundll32.exe
48	2208	rundll32.exe
49	2208	rundll32.exe
50	2208	rundll32.exe
51	2208	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	rundll32.exe
2208	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4340	1204	rundll32.exe	83
PID 1204 wrote to memory of 4340	1204	rundll32.exe	83
PID 1204 wrote to memory of 4340	1204	rundll32.exe	83
PID 4340 wrote to memory of 2208	4340	rundll32.exe	84
PID 4340 wrote to memory of 2208	4340	rundll32.exe	84
PID 4340 wrote to memory of 2208	4340	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\035ce025ac393d38b79829b53f6390870f7ab350f2286c661bcb2fcb64f9fd67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\035ce025ac393d38b79829b53f6390870f7ab350f2286c661bcb2fcb64f9fd67.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\035ce025ac393d38b79829b53f6390870f7ab350f2286c661bcb2fcb64f9fd67.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-2-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/2208-3-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/2208-4-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/4340-0-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/4340-1-0x0000000010000000-0x0000000010028000-memory.dmp

Download