emotet | 4c9d15f3c7b13f4e4ba83f1187f50541c59bf9d2831f3ca8dbef7488c966216d

General

Target
emotet_exe_e4_4c9d15f3c7b13f4e4ba83f1187f50541c59bf9d2831f3ca8dbef7488c966216d_2022-02-09__000612.dll
Size 369KB
Sample220209-aecafageg6
SHA256 4c9d15f3c7b13f4e4ba83f1187f50541c59bf9d2831f3ca8dbef7488c966216d
MD5 a072c1f1b0eb2293bd79bb9ecaa92903
SHA1 05621f857e38d8c9e2065ea3c5544f3fed894289
SHA512 536ab19258f5ce4aa1852a500a1d51af15f6c81946a21689cbdcb21dee1fc3761684237ad71ef4eca8e28b23200b12687dcdce47311d73d22d705832239caf2a
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

185.248.140.40:443
8.9.11.48:443
200.17.134.35:7080
207.38.84.195:8080
79.172.212.216:8080
45.176.232.124:443
45.118.135.203:7080
162.243.175.63:443
110.232.117.186:8080
103.75.201.4:443
195.154.133.20:443
160.16.102.168:80
164.68.99.3:8080
131.100.24.231:80
216.158.226.206:443
159.89.230.105:443
178.79.147.66:8080
178.128.83.165:80
212.237.5.209:443
82.165.152.127:8080
50.116.54.215:443
58.227.42.236:80
119.235.255.201:8080
144.76.186.49:8080
138.185.72.26:8080
162.214.50.39:7080
81.0.236.90:443
176.104.106.96:8080
144.76.186.55:7080
129.232.188.93:443
212.24.98.99:8080
203.114.109.124:443
103.75.201.2:443
173.212.193.249:8080
41.76.108.46:8080
45.118.115.99:8080
158.69.222.101:443
107.182.225.142:8080
212.237.17.99:8080
212.237.56.116:7080
159.8.59.82:8080
46.55.222.11:443
104.251.214.46:8080
31.24.158.56:8080
153.126.203.229:8080
51.254.140.238:7080
185.157.82.211:8080
217.182.143.207:443
45.142.114.231:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4056	svchost.exe
Token: SeCreatePagefilePrivilege	4056	svchost.exe
Token: SeShutdownPrivilege	4056	svchost.exe
Token: SeCreatePagefilePrivilege	4056	svchost.exe
Token: SeShutdownPrivilege	4056	svchost.exe
Token: SeCreatePagefilePrivilege	4056	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2904	5028	regsvr32.exe	82
PID 5028 wrote to memory of 2904	5028	regsvr32.exe	82
PID 5028 wrote to memory of 2904	5028	regsvr32.exe	82
PID 2904 wrote to memory of 3144	2904	regsvr32.exe	86
PID 2904 wrote to memory of 3144	2904	regsvr32.exe	86
PID 2904 wrote to memory of 3144	2904	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4c9d15f3c7b13f4e4ba83f1187f50541c59bf9d2831f3ca8dbef7488c966216d_2022-02-09__000612.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4c9d15f3c7b13f4e4ba83f1187f50541c59bf9d2831f3ca8dbef7488c966216d_2022-02-09__000612.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4c9d15f3c7b13f4e4ba83f1187f50541c59bf9d2831f3ca8dbef7488c966216d_2022-02-09__000612.dll",DllRegisterServer
    3⤵
    PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/4056-132-0x000001FD32520000-0x000001FD32530000-memory.dmp

Download

memory/4056-133-0x000001FD32740000-0x000001FD32750000-memory.dmp

Download

memory/4056-134-0x000001FD34C60000-0x000001FD34C64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads