emotet | b4cf95ff045fad20437dcad937ee24166ac29bd2680060ae0bd984b5bdf8d047

Analysis

max time kernel
119s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
19-01-2022 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4cf95ff045fad20437dcad937ee24166ac29bd2680060ae0bd984b5bdf8d047.dll
Size

408KB
MD5

48f77edd94f929c9c8d56a52f72d7a9f
SHA1

ed72b6d67c723bbeadc338aac2e6a7ae6573851f
SHA256

b4cf95ff045fad20437dcad937ee24166ac29bd2680060ae0bd984b5bdf8d047
SHA512

615486be46074b5feb4d1f41d76381dc9ddb5ed54c8b12096cf2c2a49513cdde6334bfdce0ce042876e31ef95a85c21f947c859873983d56b39dcf1fe6208b7a

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3680	3676	regsvr32.exe	68
PID 3676 wrote to memory of 3680	3676	regsvr32.exe	68
PID 3676 wrote to memory of 3680	3676	regsvr32.exe	68
PID 3680 wrote to memory of 3832	3680	regsvr32.exe	69
PID 3680 wrote to memory of 3832	3680	regsvr32.exe	69
PID 3680 wrote to memory of 3832	3680	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b4cf95ff045fad20437dcad937ee24166ac29bd2680060ae0bd984b5bdf8d047.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b4cf95ff045fad20437dcad937ee24166ac29bd2680060ae0bd984b5bdf8d047.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b4cf95ff045fad20437dcad937ee24166ac29bd2680060ae0bd984b5bdf8d047.dll",DllRegisterServer
    3⤵
    PID:3832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3680-117-0x0000000000DF0000-0x0000000000E16000-memory.dmp

Filesize
152KB

Download