emotet | a5f511ea5ed82b72fe5a00ac081ce319b3ceb75e8d14077849e5c0a4775b1b5b | Triage™

Analysis

max time kernel
110s
max time network
123s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vACAN.dll
Size 784KB
Sample220126-yleadaaad9
SHA256 a5f511ea5ed82b72fe5a00ac081ce319b3ceb75e8d14077849e5c0a4775b1b5b
MD5 a17620bdeb210955fa9370361ccf0be7
SHA1 d40824d5d3b32c85c9a604d478cf64b9456ed0b7
SHA512 05fc979855add03e05375a8202b87eef12452be23b6e84f0b18c4217579f102edd9b5e447a6591889bd726e17cc5428695dadd0ea9be1c265a4ab050d566c3b4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

185.244.166.137:443
185.168.130.138:443
59.148.253.194:443
78.46.73.125:443
195.77.239.39:8080
104.131.62.48:8080
69.16.218.101:8080
203.153.216.46:443
195.154.146.35:443
190.90.233.66:443
191.252.103.16:80
37.44.244.177:8080
168.197.250.14:80
116.124.128.206:8080
54.37.228.122:443
159.69.237.188:443
85.214.67.203:8080
210.57.209.142:8080
78.47.204.80:443
185.148.168.220:8080
142.4.219.173:8080
85.25.120.45:8080
128.199.192.135:8080
66.42.57.149:443
62.171.178.147:8080
54.38.242.185:443
217.182.143.207:443
185.148.168.15:8080
37.59.209.141:8080
207.148.81.119:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3128	2636	regsvr32.exe	68
PID 2636 wrote to memory of 3128	2636	regsvr32.exe	68
PID 2636 wrote to memory of 3128	2636	regsvr32.exe	68
PID 3128 wrote to memory of 1120	3128	regsvr32.exe	69
PID 3128 wrote to memory of 1120	3128	regsvr32.exe	69
PID 3128 wrote to memory of 1120	3128	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\vACAN.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\vACAN.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\vACAN.dll",DllRegisterServer
    3⤵
    PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3128-115-0x0000000004650000-0x0000000004677000-memory.dmp

Download