emotet | 89a8c9d2aabcbcc8b22fd363c09ef705439ee2bd229703135e4a5ceafaa59531

General

Target
99c909b303ebf89be3a6191cb11fe450.dll
Size 213KB
Sample220207-tknefaecck
SHA256 89a8c9d2aabcbcc8b22fd363c09ef705439ee2bd229703135e4a5ceafaa59531
MD5 99c909b303ebf89be3a6191cb11fe450
SHA1 b8ba65e9c16f9b238e2863a8f41624bcd76bfe69
SHA512 c8a698cc6e3f731f3181cb6e69269ad2b2f2160aa05c683a23d1804e3e877a7eba6f8cc45e77a2b014eb50ae13f631dedeb75ed7a3870a6a251ad07d3d85cbd4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

45.79.173.200:443
144.76.186.55:7080
207.38.84.195:8080
82.165.152.127:8080
45.118.115.99:8080
50.116.54.215:443
203.114.109.124:443
178.128.83.165:80
107.182.225.142:8080
192.95.56.148:8080
185.157.82.211:8080
212.237.5.209:443
212.24.98.99:8080
162.214.50.39:7080
162.243.175.63:443
176.104.106.96:8080
217.182.143.207:443
144.76.186.49:8080
58.227.42.236:80
110.232.117.186:8080
129.232.188.93:443
45.142.114.231:8080
46.55.222.11:443
103.75.201.2:443
131.100.24.231:80
200.17.134.35:7080
45.118.135.203:7080
173.212.193.249:8080
159.89.230.105:443
160.16.102.168:80
51.254.140.238:7080
119.235.255.201:8080
159.8.59.82:8080
41.76.108.46:8080
212.237.56.116:7080
216.158.226.206:443
178.79.147.66:8080
158.69.222.101:443
138.185.72.26:8080
195.154.133.20:443
164.68.99.3:8080
212.237.17.99:8080
81.0.236.90:443
79.172.212.216:8080
103.75.201.4:443
45.176.232.124:443
104.251.214.46:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	668	svchost.exe
Token: SeCreatePagefilePrivilege	668	svchost.exe
Token: SeShutdownPrivilege	668	svchost.exe
Token: SeCreatePagefilePrivilege	668	svchost.exe
Token: SeShutdownPrivilege	668	svchost.exe
Token: SeCreatePagefilePrivilege	668	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1320	4284	regsvr32.exe	81
PID 4284 wrote to memory of 1320	4284	regsvr32.exe	81
PID 4284 wrote to memory of 1320	4284	regsvr32.exe	81
PID 1320 wrote to memory of 4888	1320	regsvr32.exe	82
PID 1320 wrote to memory of 4888	1320	regsvr32.exe	82
PID 1320 wrote to memory of 4888	1320	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\99c909b303ebf89be3a6191cb11fe450.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\99c909b303ebf89be3a6191cb11fe450.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\99c909b303ebf89be3a6191cb11fe450.dll",DllRegisterServer
    3⤵
    PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-132-0x000002077F130000-0x000002077F140000-memory.dmp

Download

memory/668-133-0x000002077F190000-0x000002077F1A0000-memory.dmp

Download

memory/668-134-0x000002077FE70000-0x000002077FE74000-memory.dmp

Download

memory/1320-130-0x0000000010000000-0x0000000010025000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads