emotet | 9242e85ab71416c52a3fa2ed0a5b9cf5d057d498649b02f9b7e9d2d8df2de076

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-en-20211208
submitted
25/01/2022, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caf39191cc7501d940f39237880ef0c2.dll
Size 660KB
Sample220125-ym4lnadger
SHA256 9242e85ab71416c52a3fa2ed0a5b9cf5d057d498649b02f9b7e9d2d8df2de076
MD5 caf39191cc7501d940f39237880ef0c2
SHA1 cf0435904708a748131e07ed103d95cb04d66057
SHA512 9888c7ef17f86a8d57a004c5e626d34ad28579eb6f702b29f2873d4c53cd1488864951fc55bee6669c77534bb6419d50012a8f6c97df011e141eaddc54f4dae6
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.77.82.125:443
69.197.160.180:8080
103.75.201.2:443
173.212.193.249:8080
45.118.135.203:7080
45.118.115.99:8080
162.243.175.63:443
192.254.71.210:443
50.116.54.215:443
51.38.71.0:443
138.185.72.26:8080
131.100.24.231:80
212.237.5.209:443
209.59.138.75:7080
176.104.106.96:8080
107.182.225.142:8080
45.142.114.231:8080
212.237.56.116:7080
207.38.84.195:8080
158.69.222.101:443
104.251.214.46:8080
104.168.155.129:8080
46.55.222.11:443
103.8.26.102:8080
58.227.42.236:80
164.68.99.3:8080
203.114.109.124:443
216.158.226.206:443
178.63.25.185:443
103.8.26.103:8080
195.154.133.20:443
45.176.232.124:443
41.76.108.46:8080
81.0.236.90:443
178.79.147.66:8080
212.24.98.99:8080
217.182.143.207:443
110.232.117.186:8080
162.214.50.39:7080
212.237.17.99:8080
185.157.82.211:8080
79.172.212.216:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 748 wrote to memory of 524	748	regsvr32.exe	27
PID 524 wrote to memory of 784	524	regsvr32.exe	28
PID 524 wrote to memory of 784	524	regsvr32.exe	28
PID 524 wrote to memory of 784	524	regsvr32.exe	28
PID 524 wrote to memory of 784	524	regsvr32.exe	28
PID 524 wrote to memory of 784	524	regsvr32.exe	28
PID 524 wrote to memory of 784	524	regsvr32.exe	28
PID 524 wrote to memory of 784	524	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\caf39191cc7501d940f39237880ef0c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\caf39191cc7501d940f39237880ef0c2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\caf39191cc7501d940f39237880ef0c2.dll",DllRegisterServer
    3⤵
    PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/524-57-0x00000000003C0000-0x00000000003E5000-memory.dmp

Download

memory/524-56-0x00000000003C1000-0x00000000003E2000-memory.dmp

Download

memory/748-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads