emotet | 5f998aa13879142f9cfaee66ae8fd23ee16ae00a556e4a5e27d25fe392b81f7c

General

Target
emotet_exe_e5_5f998aa13879142f9cfaee66ae8fd23ee16ae00a556e4a5e27d25fe392b81f7c_2022-02-09__000853.dll
Size 575KB
Sample220209-af3tsagfa9
SHA256 5f998aa13879142f9cfaee66ae8fd23ee16ae00a556e4a5e27d25fe392b81f7c
MD5 7b15d85d9b28d7f673e863a4e34a9ef1
SHA1 3b0597fd0dfe26a1534edd740ffaadc75b1cc616
SHA512 5c1a47cb7addbd7a3346d595cd2423333e4eee94365eeb4fd045851fa7c991729596ad25380b213037441ed7ef5fa704c5d2ad5273b1823ff1a4774b1116a017
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.42.57.17:8080
93.104.208.37:8080
195.154.146.35:443
62.171.178.147:8080
37.59.209.141:8080
139.196.72.155:8080
37.44.244.177:8080
191.252.103.16:80
217.182.143.207:443
128.199.192.135:8080
103.41.204.169:8080
185.148.168.15:8080
168.197.250.14:80
78.46.73.125:443
194.9.172.107:8080
185.148.168.220:8080
118.98.72.86:443
54.37.106.167:8080
78.47.204.80:443
159.69.237.188:443
116.124.128.206:8080
59.148.253.194:443
85.214.67.203:8080
185.184.25.78:8080
173.203.78.138:443
54.37.228.122:443
198.199.98.78:8080
195.77.239.39:8080
210.57.209.142:8080
66.42.57.149:443
104.131.62.48:8080
54.38.242.185:443
190.90.233.66:443
207.148.81.119:8080
203.153.216.46:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4860	svchost.exe
Token: SeCreatePagefilePrivilege	4860	svchost.exe
Token: SeShutdownPrivilege	4860	svchost.exe
Token: SeCreatePagefilePrivilege	4860	svchost.exe
Token: SeShutdownPrivilege	4860	svchost.exe
Token: SeCreatePagefilePrivilege	4860	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4872	1412	regsvr32.exe	84
PID 1412 wrote to memory of 4872	1412	regsvr32.exe	84
PID 1412 wrote to memory of 4872	1412	regsvr32.exe	84
PID 4872 wrote to memory of 920	4872	regsvr32.exe	85
PID 4872 wrote to memory of 920	4872	regsvr32.exe	85
PID 4872 wrote to memory of 920	4872	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5f998aa13879142f9cfaee66ae8fd23ee16ae00a556e4a5e27d25fe392b81f7c_2022-02-09__000853.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5f998aa13879142f9cfaee66ae8fd23ee16ae00a556e4a5e27d25fe392b81f7c_2022-02-09__000853.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5f998aa13879142f9cfaee66ae8fd23ee16ae00a556e4a5e27d25fe392b81f7c_2022-02-09__000853.dll",DllRegisterServer
    3⤵
    PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-133-0x000002503FD20000-0x000002503FD30000-memory.dmp

Download

memory/4860-132-0x000002503F760000-0x000002503F770000-memory.dmp

Download

memory/4860-134-0x00000250423B0000-0x00000250423B4000-memory.dmp

Download

memory/4872-130-0x0000000010000000-0x0000000010025000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads