emotet | 1e6c3eec9449508f89f0bca76609119dceb7e47d1b0abb7d175d9e70da49c1b9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
03-01-2022 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xxxxxxxxe5.dll
Size

258KB
MD5

db7497d833b93784e4954c57f9d2718d
SHA1

cad0a3e91dd44c5ff1eccbeeb5045be8f277ef13
SHA256

1e6c3eec9449508f89f0bca76609119dceb7e47d1b0abb7d175d9e70da49c1b9
SHA512

a88e6ef264f70ddf5d498ef5857962611be6c3f4ad07ecca2f16c597b0c6678d1a47f8b722baaf41f1c0a283d7cab8d31a13d0c27d7f95a049915cf54bc4845c

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

209.239.112.82:8080

116.124.128.206:8080

45.63.5.129:443

128.199.192.135:8080

51.178.61.60:443

168.197.250.14:80

177.72.80.14:7080

51.210.242.234:8080

142.4.219.173:8080

78.47.204.80:443

78.46.73.125:443

37.44.244.177:8080

37.59.209.141:8080

104.131.62.48:8080

190.90.233.66:443

185.148.168.220:8080

185.148.168.15:8080

62.171.178.147:8080

191.252.103.16:80

54.38.242.185:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1600 wrote to memory of 1516	1600	regsvr32.exe	regsvr32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe
PID 1516 wrote to memory of 1764	1516	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xxxxxxxxe5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\xxxxxxxxe5.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\xxxxxxxxe5.dll",DllRegisterServer
3⤵
PID:1764

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-55-0x0000000000000000-mapping.dmp

Download
memory/1516-56-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1516-59-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1600-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1764-57-0x0000000000000000-mapping.dmp

Download