emotet | 102985be1cdd3ca4edf71677f50de88ddb2d534d9fa0b3e4b619231e7100ccc2

Analysis

max time kernel
166s
max time network
177s
platform
windows10_x64
resource
win10-en-20211208
submitted
28-01-2022 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

102985be1cdd3ca4edf71677f50de88ddb2d534d9fa0b3e4b619231e7100ccc2.dll
Size

520KB
MD5

81cf709fa4178d1091dd3d7247488ba7
SHA1

4a85a37322350612fa9606ac219aae749ed36ee3
SHA256

102985be1cdd3ca4edf71677f50de88ddb2d534d9fa0b3e4b619231e7100ccc2
SHA512

2c6b8ee2d944ff7a9f6293da727b6ac0b232cd634c7b85b33f98c958178ecf936ec767dce4a4d6f3797063220c1da81530cbfb0abca82d4f4f3c66fc9d060415

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

159.69.43.124:8080

45.79.80.198:443

207.148.81.119:8080

128.199.192.135:8080

118.98.72.86:443

217.182.143.207:443

168.197.250.14:80

116.124.128.206:8080

78.46.73.125:443

185.148.168.15:8080

195.154.146.35:443

85.214.67.203:8080

194.9.172.107:8080

59.148.253.194:443

210.57.209.142:8080

54.38.242.185:443

195.77.239.39:8080

159.69.237.188:443

104.131.62.48:8080

62.171.178.147:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2672 wrote to memory of 2324	2672	regsvr32.exe	regsvr32.exe
PID 2672 wrote to memory of 2324	2672	regsvr32.exe	regsvr32.exe
PID 2672 wrote to memory of 2324	2672	regsvr32.exe	regsvr32.exe
PID 2324 wrote to memory of 2752	2324	regsvr32.exe	rundll32.exe
PID 2324 wrote to memory of 2752	2324	regsvr32.exe	rundll32.exe
PID 2324 wrote to memory of 2752	2324	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\102985be1cdd3ca4edf71677f50de88ddb2d534d9fa0b3e4b619231e7100ccc2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\102985be1cdd3ca4edf71677f50de88ddb2d534d9fa0b3e4b619231e7100ccc2.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\102985be1cdd3ca4edf71677f50de88ddb2d534d9fa0b3e4b619231e7100ccc2.dll",DllRegisterServer
3⤵
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-116-0x0000000001010000-0x0000000001037000-memory.dmp

Filesize
156KB

Download