emotet | de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2

Analysis

max time kernel
165s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
09/02/2022, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll
Size 369KB
Sample220209-aecafageg2
SHA256 de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2
MD5 8c228e333bf13944dc5373e56066cff3
SHA1 71bb0373f2b3d7591318f736eb85339be4a8feea
SHA512 ae588226077afdcae01d57462c5ba6c6dd5c6f8dc845f748a98ea6b6ec38fa942cf7a3605dbec8ae4602a2fb4103cd2d5f97fefa72e142aece0ab3aa88ea766e
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

185.248.140.40:443
8.9.11.48:443
200.17.134.35:7080
207.38.84.195:8080
79.172.212.216:8080
45.176.232.124:443
45.118.135.203:7080
162.243.175.63:443
110.232.117.186:8080
103.75.201.4:443
195.154.133.20:443
160.16.102.168:80
164.68.99.3:8080
131.100.24.231:80
216.158.226.206:443
159.89.230.105:443
178.79.147.66:8080
178.128.83.165:80
212.237.5.209:443
82.165.152.127:8080
50.116.54.215:443
58.227.42.236:80
119.235.255.201:8080
144.76.186.49:8080
138.185.72.26:8080
162.214.50.39:7080
81.0.236.90:443
176.104.106.96:8080
144.76.186.55:7080
129.232.188.93:443
212.24.98.99:8080
203.114.109.124:443
103.75.201.2:443
173.212.193.249:8080
41.76.108.46:8080
45.118.115.99:8080
158.69.222.101:443
107.182.225.142:8080
212.237.17.99:8080
212.237.56.116:7080
159.8.59.82:8080
46.55.222.11:443
104.251.214.46:8080
31.24.158.56:8080
153.126.203.229:8080
51.254.140.238:7080
185.157.82.211:8080
217.182.143.207:443
45.142.114.231:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5040	svchost.exe
Token: SeCreatePagefilePrivilege	5040	svchost.exe
Token: SeShutdownPrivilege	5040	svchost.exe
Token: SeCreatePagefilePrivilege	5040	svchost.exe
Token: SeShutdownPrivilege	5040	svchost.exe
Token: SeCreatePagefilePrivilege	5040	svchost.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe
Token: SeBackupPrivilege	5048	TiWorker.exe
Token: SeRestorePrivilege	5048	TiWorker.exe
Token: SeSecurityPrivilege	5048	TiWorker.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1412	1552	regsvr32.exe	82
PID 1552 wrote to memory of 1412	1552	regsvr32.exe	82
PID 1552 wrote to memory of 1412	1552	regsvr32.exe	82
PID 1412 wrote to memory of 2944	1412	regsvr32.exe	85
PID 1412 wrote to memory of 2944	1412	regsvr32.exe	85
PID 1412 wrote to memory of 2944	1412	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll",DllRegisterServer
    3⤵
    PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/5040-132-0x0000027AE4B90000-0x0000027AE4BA0000-memory.dmp

Download

memory/5040-133-0x0000027AE5220000-0x0000027AE5230000-memory.dmp

Download

memory/5040-134-0x0000027AE7910000-0x0000027AE7914000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads