emotet | 55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e

General

Target
emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll
Size 575KB
Sample220209-af3tsagfb3
SHA256 55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e
MD5 4cb663afec1670344c72dd8ca72498f0
SHA1 2b66ae419e4c2495cb6b44e86fa89a388f174d22
SHA512 ff82507e948142be6b28914515b213490b8773041501484c19669343a43f8b2c90176c554b6b54108734e1e04dd9f68be4cffa9fdc20f7c8059b4d3f6b834e85
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.42.57.17:8080
93.104.208.37:8080
195.154.146.35:443
62.171.178.147:8080
37.59.209.141:8080
139.196.72.155:8080
37.44.244.177:8080
191.252.103.16:80
217.182.143.207:443
128.199.192.135:8080
103.41.204.169:8080
185.148.168.15:8080
168.197.250.14:80
78.46.73.125:443
194.9.172.107:8080
185.148.168.220:8080
118.98.72.86:443
54.37.106.167:8080
78.47.204.80:443
159.69.237.188:443
116.124.128.206:8080
59.148.253.194:443
85.214.67.203:8080
185.184.25.78:8080
173.203.78.138:443
54.37.228.122:443
198.199.98.78:8080
195.77.239.39:8080
210.57.209.142:8080
66.42.57.149:443
104.131.62.48:8080
54.38.242.185:443
190.90.233.66:443
207.148.81.119:8080
203.153.216.46:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3992	svchost.exe
Token: SeCreatePagefilePrivilege	3992	svchost.exe
Token: SeShutdownPrivilege	3992	svchost.exe
Token: SeCreatePagefilePrivilege	3992	svchost.exe
Token: SeShutdownPrivilege	3992	svchost.exe
Token: SeCreatePagefilePrivilege	3992	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1332	1348	regsvr32.exe	83
PID 1348 wrote to memory of 1332	1348	regsvr32.exe	83
PID 1348 wrote to memory of 1332	1348	regsvr32.exe	83
PID 1332 wrote to memory of 2876	1332	regsvr32.exe	85
PID 1332 wrote to memory of 2876	1332	regsvr32.exe	85
PID 1332 wrote to memory of 2876	1332	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll",DllRegisterServer
    3⤵
    PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-130-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/3992-132-0x00000216DF920000-0x00000216DF930000-memory.dmp

Download

memory/3992-133-0x00000216DFB40000-0x00000216DFB50000-memory.dmp

Download

memory/3992-134-0x00000216E2050000-0x00000216E2054000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads