emotet | 3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d

General

Target
emotet_exe_e5_3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d_2022-02-08__000049.dll
Size 600KB
Sample220208-aaxetabaa3
SHA256 3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d
MD5 2b596050f220ce0d74051e6c4be3a64c
SHA1 6c76d4b58f144efd8c43b1617dc2507af152d03e
SHA512 8975ed7680af244ba0ea3a8e49413756bdaeb915b2518167ad012b057a0014d470e1eddbf20a2bf94f0861ac802e08f7d69967c70aecc06aaaa2666c5a6604b2
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.42.57.17:8080
93.104.208.37:8080
195.154.146.35:443
62.171.178.147:8080
37.59.209.141:8080
139.196.72.155:8080
37.44.244.177:8080
191.252.103.16:80
217.182.143.207:443
128.199.192.135:8080
103.41.204.169:8080
185.148.168.15:8080
168.197.250.14:80
78.46.73.125:443
194.9.172.107:8080
185.148.168.220:8080
118.98.72.86:443
54.37.106.167:8080
78.47.204.80:443
159.69.237.188:443
116.124.128.206:8080
59.148.253.194:443
85.214.67.203:8080
185.184.25.78:8080
173.203.78.138:443
54.37.228.122:443
198.199.98.78:8080
195.77.239.39:8080
210.57.209.142:8080
66.42.57.149:443
104.131.62.48:8080
54.38.242.185:443
190.90.233.66:443
207.148.81.119:8080
203.153.216.46:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3740	svchost.exe
Token: SeCreatePagefilePrivilege	3740	svchost.exe
Token: SeShutdownPrivilege	3740	svchost.exe
Token: SeCreatePagefilePrivilege	3740	svchost.exe
Token: SeShutdownPrivilege	3740	svchost.exe
Token: SeCreatePagefilePrivilege	3740	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 1484	3220	regsvr32.exe	82
PID 3220 wrote to memory of 1484	3220	regsvr32.exe	82
PID 3220 wrote to memory of 1484	3220	regsvr32.exe	82
PID 1484 wrote to memory of 4064	1484	regsvr32.exe	85
PID 1484 wrote to memory of 4064	1484	regsvr32.exe	85
PID 1484 wrote to memory of 4064	1484	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d_2022-02-08__000049.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d_2022-02-08__000049.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d_2022-02-08__000049.dll",DllRegisterServer
    3⤵
    PID:4064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-130-0x0000000000E00000-0x0000000000E25000-memory.dmp

Download

memory/3740-132-0x0000024077730000-0x0000024077740000-memory.dmp

Download

memory/3740-133-0x0000024077790000-0x00000240777A0000-memory.dmp

Download

memory/3740-134-0x000002407A4A0000-0x000002407A4A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads