emotet | a13717ac7014e0eb85a5d0a2d3968eb63ba14c7a18245e50d0f7e2eecc9f57dd | Triage™

Analysis

max time kernel
121s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
09/12/2021, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xihllT5.dll
Size 258KB
Sample211209-we6d6sdbb7
SHA256 a13717ac7014e0eb85a5d0a2d3968eb63ba14c7a18245e50d0f7e2eecc9f57dd
MD5 eb86b85a7fec7fe6aade1d4f1cfc9fde
SHA1 5755575afa086a7d19e4f5042cb6e54cd2e9bd53
SHA512 42d83c154cdcac04204288b1cdc87b189ddf91cb09e49e4904b4da6fb10323da39addad6b7f4f3f0fbd5db7d8786a3d721d8004041b8687c84dcbc530b618728
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

209.239.112.82:8080
116.124.128.206:8080
45.63.5.129:443
128.199.192.135:8080
51.178.61.60:443
168.197.250.14:80
177.72.80.14:7080
51.210.242.234:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
104.131.62.48:8080
190.90.233.66:443
185.148.168.220:8080
185.148.168.15:8080
62.171.178.147:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
217.182.143.207:443
159.69.237.188:443
210.57.209.142:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4068	2584	regsvr32.exe	68
PID 2584 wrote to memory of 4068	2584	regsvr32.exe	68
PID 2584 wrote to memory of 4068	2584	regsvr32.exe	68
PID 4068 wrote to memory of 736	4068	regsvr32.exe	69
PID 4068 wrote to memory of 736	4068	regsvr32.exe	69
PID 4068 wrote to memory of 736	4068	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xihllT5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xihllT5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\xihllT5.dll",DllRegisterServer
    3⤵
    PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4068-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download