emotet | f8498f0561321c0d8f5e176090d767e1a0fe5ef7053d23c9924784d8814ad2a9

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8498f0561321c0d8f5e176090d767e1a0fe5ef7053d23c9924784d8814ad2a9.dll
Size

202KB
MD5

e07cd432329ec780fc32cb8e7c84abf2
SHA1

659acbc0fdf75daf6d75e99e937f1a45fdf3292c
SHA256

f8498f0561321c0d8f5e176090d767e1a0fe5ef7053d23c9924784d8814ad2a9
SHA512

ca33e91f671d1e2c3634bb3f5a9ee93f88934f17c766f7826ce11476b5bb48df472768f3993f29e9b27db2ee791001f8d181b4f9d8f497b0a56d94c384ba05b9
SSDEEP

3072:XO2Rkqx4iT+TeybMVjHGLEgj438DIOWQQlL/oEBPCZRAkf9zz:+2RkQtGL34321QtoQwxz

Score

10^/10

emotet epoch1 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

152.170.79.100:80

190.247.139.101:80

138.197.99.250:8080

167.71.148.58:443

211.215.18.93:8080

191.241.233.198:80

83.169.21.32:7080

113.163.216.135:80

70.32.84.74:8080

217.13.106.14:8080

177.23.7.151:80

172.104.169.32:8080

187.39.237.56:8080

80.15.100.37:80

177.144.130.105:443

168.121.4.238:80

1.234.65.61:80

191.182.6.118:80

170.81.48.2:80

45.184.103.73:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Blocklisted process makes network request 8 IoCs

Processes:

rundll32.exe

flow	pid	Process
3	1924	rundll32.exe
5	1924	rundll32.exe
8	1924	rundll32.exe
9	1924	rundll32.exe
12	1924	rundll32.exe
13	1924	rundll32.exe
15	1924	rundll32.exe
18	1924	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rundll32.exe

pid	Process
1924	rundll32.exe
1924	rundll32.exe
1924	rundll32.exe
1924	rundll32.exe
1924	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30
PID 2288 wrote to memory of 1924	2288	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8498f0561321c0d8f5e176090d767e1a0fe5ef7053d23c9924784d8814ad2a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8498f0561321c0d8f5e176090d767e1a0fe5ef7053d23c9924784d8814ad2a9.dll,#1
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x00000000002E0000-0x00000000002FF000-memory.dmp

Filesize
124KB

Download