emotet | 3941d3a7db43557f478efee994cb79aa78453fa5a62b845d0c76dc1ab95aa48f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-en-20211208
submitted
26/01/2022, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76167fd34b96bf58b70fd009928c097f.dll
Size 705KB
Sample220126-rraqtadgbn
SHA256 3941d3a7db43557f478efee994cb79aa78453fa5a62b845d0c76dc1ab95aa48f
MD5 76167fd34b96bf58b70fd009928c097f
SHA1 c63b5d4293ed513a2ffd944133b7898c10d2ef11
SHA512 bd9593bcaf2227f0a9b1530758e63b321c97c2159ad31a7d29edf713c886a52cd39732a9a7dac00559603228a53166070f83f71575ac811a6e55c1b3dfecaa48
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.77.82.125:443
69.197.160.180:8080
103.75.201.2:443
173.212.193.249:8080
45.118.135.203:7080
45.118.115.99:8080
162.243.175.63:443
192.254.71.210:443
50.116.54.215:443
51.38.71.0:443
138.185.72.26:8080
131.100.24.231:80
212.237.5.209:443
209.59.138.75:7080
176.104.106.96:8080
107.182.225.142:8080
45.142.114.231:8080
212.237.56.116:7080
207.38.84.195:8080
158.69.222.101:443
104.251.214.46:8080
104.168.155.129:8080
46.55.222.11:443
103.8.26.102:8080
58.227.42.236:80
164.68.99.3:8080
203.114.109.124:443
216.158.226.206:443
178.63.25.185:443
103.8.26.103:8080
195.154.133.20:443
45.176.232.124:443
41.76.108.46:8080
81.0.236.90:443
178.79.147.66:8080
212.24.98.99:8080
217.182.143.207:443
110.232.117.186:8080
162.214.50.39:7080
212.237.17.99:8080
185.157.82.211:8080
79.172.212.216:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\76167fd34b96bf58b70fd009928c097f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\76167fd34b96bf58b70fd009928c097f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\76167fd34b96bf58b70fd009928c097f.dll",DllRegisterServer
    3⤵
    PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-56-0x0000000076B81000-0x0000000076B83000-memory.dmp

Download

memory/1520-58-0x00000000001E0000-0x0000000000205000-memory.dmp

Download

memory/1520-57-0x00000000001E1000-0x0000000000202000-memory.dmp

Download

memory/1752-55-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads