emotet | a52080f1a8c69cec03f3fcf6bcea8cc4ba5941b758ee543b8dc81f767972d287

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a52080f1a8c69cec03f3fcf6bcea8cc4ba5941b758ee543b8dc81f767972d287N.dll
Size

180KB
MD5

40aba4218c04e1cd8ba07a5fd40aaee0
SHA1

66d8eab5fcb1a5621e7f994f971c24ee793f16df
SHA256

a52080f1a8c69cec03f3fcf6bcea8cc4ba5941b758ee543b8dc81f767972d287
SHA512

71c10eb2b7895af1a79fd3804c9cfaf3f6382fd8e13a99c541e04d4f37da35e64bcd40c176e5160d8cc6deadb7d9389ca7cd09a7516d176b745b078593157dd7
SSDEEP

3072:aH6G2caO5pi1quetITzxT+/q5+VA0JH2g+5CPL0dbjSL0BnA:aDDaO5Y1vTUq02T5CPm/A

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

212.24.98.99:8080

51.91.76.89:8080

94.23.45.86:4143

101.50.0.91:8080

103.43.75.120:443

212.237.17.99:8080

158.69.222.101:443

51.254.140.238:7080

1.234.2.232:8080

91.207.28.33:8080

167.172.253.162:8080

45.235.8.30:8080

115.68.227.76:8080

134.122.66.193:8080

89.29.244.7:443

197.242.150.244:8080

164.68.99.3:8080

5.9.116.246:8080

1.234.21.73:7080

131.100.24.231:80

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid	Process
2344	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2344 wrote to memory of 684	2344	rundll32.exe	31
PID 2344 wrote to memory of 684	2344	rundll32.exe	31
PID 2344 wrote to memory of 684	2344	rundll32.exe	31
PID 2344 wrote to memory of 684	2344	rundll32.exe	31
PID 2344 wrote to memory of 684	2344	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a52080f1a8c69cec03f3fcf6bcea8cc4ba5941b758ee543b8dc81f767972d287N.dll,#1
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OBsFumsdkMIuqrwQ\HxzBMKtE.dll"
  2⤵
  PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2344-0-0x000007FEF7B80000-0x000007FEF7BAF000-memory.dmp

Filesize
188KB

Download