emotet | 419547ce68632e602ca40ecd4fa69d9fcb7c250cbe873a75dbc23848ebd965b7

General

Target
emotet_exe_e4_419547ce68632e602ca40ecd4fa69d9fcb7c250cbe873a75dbc23848ebd965b7_2022-02-09__000612.dll
Size 369KB
Sample220209-aecafageg4
SHA256 419547ce68632e602ca40ecd4fa69d9fcb7c250cbe873a75dbc23848ebd965b7
MD5 46752d7d74864b5dc5bb9e2e7e85a866
SHA1 cbd23a7bba783622f2bd723336efe43d0ca65f7e
SHA512 ed7a53d8f81fc27e2f606dc766a6eb14ec69a77e7b190ee1856904b723606e183ea9afdcc940680b9224e5bcf86df706ffc531c1e9dbbc4940115d7b9edb4011
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

185.248.140.40:443
8.9.11.48:443
200.17.134.35:7080
207.38.84.195:8080
79.172.212.216:8080
45.176.232.124:443
45.118.135.203:7080
162.243.175.63:443
110.232.117.186:8080
103.75.201.4:443
195.154.133.20:443
160.16.102.168:80
164.68.99.3:8080
131.100.24.231:80
216.158.226.206:443
159.89.230.105:443
178.79.147.66:8080
178.128.83.165:80
212.237.5.209:443
82.165.152.127:8080
50.116.54.215:443
58.227.42.236:80
119.235.255.201:8080
144.76.186.49:8080
138.185.72.26:8080
162.214.50.39:7080
81.0.236.90:443
176.104.106.96:8080
144.76.186.55:7080
129.232.188.93:443
212.24.98.99:8080
203.114.109.124:443
103.75.201.2:443
173.212.193.249:8080
41.76.108.46:8080
45.118.115.99:8080
158.69.222.101:443
107.182.225.142:8080
212.237.17.99:8080
212.237.56.116:7080
159.8.59.82:8080
46.55.222.11:443
104.251.214.46:8080
31.24.158.56:8080
153.126.203.229:8080
51.254.140.238:7080
185.157.82.211:8080
217.182.143.207:443
45.142.114.231:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3272	svchost.exe
Token: SeCreatePagefilePrivilege	3272	svchost.exe
Token: SeShutdownPrivilege	3272	svchost.exe
Token: SeCreatePagefilePrivilege	3272	svchost.exe
Token: SeShutdownPrivilege	3272	svchost.exe
Token: SeCreatePagefilePrivilege	3272	svchost.exe
Token: SeSecurityPrivilege	2116	TiWorker.exe
Token: SeRestorePrivilege	2116	TiWorker.exe
Token: SeBackupPrivilege	2116	TiWorker.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2636	1948	regsvr32.exe	82
PID 1948 wrote to memory of 2636	1948	regsvr32.exe	82
PID 1948 wrote to memory of 2636	1948	regsvr32.exe	82
PID 2636 wrote to memory of 4536	2636	regsvr32.exe	85
PID 2636 wrote to memory of 4536	2636	regsvr32.exe	85
PID 2636 wrote to memory of 4536	2636	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_419547ce68632e602ca40ecd4fa69d9fcb7c250cbe873a75dbc23848ebd965b7_2022-02-09__000612.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_419547ce68632e602ca40ecd4fa69d9fcb7c250cbe873a75dbc23848ebd965b7_2022-02-09__000612.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_419547ce68632e602ca40ecd4fa69d9fcb7c250cbe873a75dbc23848ebd965b7_2022-02-09__000612.dll",DllRegisterServer
    3⤵
    PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/3272-132-0x000001CDB1960000-0x000001CDB1970000-memory.dmp

Download

memory/3272-133-0x000001CDB1F20000-0x000001CDB1F30000-memory.dmp

Download

memory/3272-134-0x000001CDB45E0000-0x000001CDB45E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads