emotet | fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d.dll
Size

174KB
MD5

4c86fa29095bca124eb5adda29626ba4
SHA1

09b0cc75535fa172607c5da5f6c6d000707ec961
SHA256

fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d
SHA512

d8687adc1d08713c7ad73e404a6c301153c5d31f1b9b0aad40c31a0a4ebf1e3ea25a6300056a2f19f47e1bc29ceb1e7580446a0492c78496672d266cd9c6b7fc
SSDEEP

3072:5AYnGS6+1acqrMsVOeKSJYv8m+sVrsTGhB/BDE9aVDZ:5AnSb1Q4sVOeKSJ+X7hB/dFV

Score

10^/10

emotet epoch2 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

74.58.215.226:80

24.164.79.147:8080

157.245.123.197:8080

50.116.111.59:8080

173.249.20.233:443

78.188.225.105:80

75.177.207.146:80

136.244.110.184:8080

194.190.67.75:80

70.92.118.112:80

110.145.101.66:443

194.4.58.192:7080

217.20.166.178:7080

109.74.5.95:8080

110.145.11.73:80

66.57.108.14:443

78.189.148.42:80

144.217.7.207:7080

120.150.60.189:80

37.139.21.175:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow	pid	Process
18	740	rundll32.exe
32	740	rundll32.exe
35	740	rundll32.exe
41	740	rundll32.exe
43	740	rundll32.exe
45	740	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

rundll32.exe

pid	Process
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe
740	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 796 wrote to memory of 740	796	rundll32.exe	83
PID 796 wrote to memory of 740	796	rundll32.exe	83
PID 796 wrote to memory of 740	796	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd0deb72554d2681e0e96785845f646624d1ecedad2226d3d21ad35426abda9d.dll,#1
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-0-0x0000000002910000-0x0000000002930000-memory.dmp

Filesize
128KB

Download