emotet | ead619ffd29d8bd6f7183449b758b855a985edd92d61eabeba0b8fd08c37d301

Analysis

max time kernel
121s
max time network
121s
platform
windows10_x64
resource
win10-en-20211104
submitted
07-12-2021 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead619ffd29d8bd6f7183449b758b855a985edd92d61eabeba0b8fd08c37d301.dll
Size

749KB
MD5

46f8f0d02c46cf12496fc1b4e2044e4f
SHA1

954937aa7cc612958f707e28a951e3106f073756
SHA256

ead619ffd29d8bd6f7183449b758b855a985edd92d61eabeba0b8fd08c37d301
SHA512

f58f949bb6d2242f9cef829dc58475f5760c3d6d1fb993f3d9642d35f393e90c8d42d6166260c71fc3d632d6d6bafb652894e46bdd539962b0525234c01536be

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

209.239.112.82:8080

116.124.128.206:8080

45.63.5.129:443

128.199.192.135:8080

51.178.61.60:443

168.197.250.14:80

177.72.80.14:7080

51.210.242.234:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

104.131.62.48:8080

190.90.233.66:443

185.148.168.220:8080

185.148.168.15:8080

62.171.178.147:8080

191.252.103.16:80

54.38.242.185:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2588 wrote to memory of 2600	2588	regsvr32.exe	regsvr32.exe
PID 2588 wrote to memory of 2600	2588	regsvr32.exe	regsvr32.exe
PID 2588 wrote to memory of 2600	2588	regsvr32.exe	regsvr32.exe
PID 2600 wrote to memory of 2676	2600	regsvr32.exe	rundll32.exe
PID 2600 wrote to memory of 2676	2600	regsvr32.exe	rundll32.exe
PID 2600 wrote to memory of 2676	2600	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ead619ffd29d8bd6f7183449b758b855a985edd92d61eabeba0b8fd08c37d301.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ead619ffd29d8bd6f7183449b758b855a985edd92d61eabeba0b8fd08c37d301.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ead619ffd29d8bd6f7183449b758b855a985edd92d61eabeba0b8fd08c37d301.dll",DllRegisterServer
3⤵
PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-118-0x0000000000000000-mapping.dmp

Download
memory/2600-120-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/2676-119-0x0000000000000000-mapping.dmp

Download