emotet | 1f3e7643c59cbb741017b42999e9f1cdd5ce11517b10426e8ac25bdc6b01feeb

Analysis

max time kernel
67s
max time network
69s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f3e7643c59cbb741017b42999e9f1cdd5ce11517b10426e8ac25bdc6b01feeb.dll
Size

780KB
MD5

e09160e48316d4b57d5aacce6d745b65
SHA1

ff2aa6bc6c0cb945a37fd3e6767e7a0d0164d863
SHA256

1f3e7643c59cbb741017b42999e9f1cdd5ce11517b10426e8ac25bdc6b01feeb
SHA512

0a92f40a4bd89c6e11c6f4ba1eab33a1c6c017a2ae62e320e206d4c881c4e689b48ea3f09da371addaf60073cee0987f38481c0e24334c7d3e5e705a23de1198

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

45.80.148.200:443

80.211.3.13:8080

110.232.117.186:8080

45.142.114.231:8080

131.100.24.231:80

107.182.225.142:8080

45.118.135.203:7080

164.68.99.3:8080

212.237.56.116:7080

41.76.108.46:8080

58.227.42.236:80

104.168.155.129:8080

79.172.212.216:8080

192.254.71.210:443

51.38.71.0:443

217.182.143.207:443

203.114.109.124:443

185.157.82.211:8080

173.212.193.249:8080

45.176.232.124:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 668	3064	regsvr32.exe	69
PID 3064 wrote to memory of 668	3064	regsvr32.exe	69
PID 3064 wrote to memory of 668	3064	regsvr32.exe	69
PID 668 wrote to memory of 2520	668	regsvr32.exe	70
PID 668 wrote to memory of 2520	668	regsvr32.exe	70
PID 668 wrote to memory of 2520	668	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f3e7643c59cbb741017b42999e9f1cdd5ce11517b10426e8ac25bdc6b01feeb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1f3e7643c59cbb741017b42999e9f1cdd5ce11517b10426e8ac25bdc6b01feeb.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1f3e7643c59cbb741017b42999e9f1cdd5ce11517b10426e8ac25bdc6b01feeb.dll",DllRegisterServer
    3⤵
    PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-115-0x0000000003680000-0x00000000036A5000-memory.dmp

Filesize
148KB

Download