emotet | 7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4

General

Target
emotet_exe_e5_7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4_2022-02-24__213827.dll
Size 1.0MB
Sample220224-1hmtfsfabl
SHA256 7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4
MD5 881aefe9d12781baeb26dbeb64590710
SHA1 1335b08dfbeab7196fbc05940b9506f5c2ad04f7
SHA512 4b7a714cb4fcd8a872d61407e2373b6112b3490eb482c3147839762d23e4a1359c09760a6ebb5789b3e7f8a0d57b70de40a0e50445d982bf6499fb70f09c96b4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

46.41.130.218:8080
168.197.250.14:80
195.77.239.39:8080
210.57.209.142:8080
203.153.216.46:443
45.71.195.104:8080
185.148.168.15:8080
78.46.73.125:443
116.124.128.206:8080
68.183.93.250:443
54.37.106.167:8080
66.42.57.149:443
103.41.204.169:8080
62.171.178.147:8080
37.59.209.141:8080
61.7.231.229:443
185.148.168.220:8080
139.196.72.155:8080
194.9.172.107:8080
191.252.103.16:80
195.154.146.35:443
61.7.231.226:443
59.148.253.194:443
217.182.143.207:443
118.98.72.86:443
37.44.244.177:8080
85.214.67.203:8080
54.37.228.122:443
198.199.98.78:8080
104.131.62.48:8080
54.38.242.185:443
78.47.204.80:443
190.90.233.66:443
27.254.174.84:8080
207.148.81.119:8080
128.199.192.135:8080
185.184.25.78:8080
159.69.237.188:443
93.104.209.107:8080
173.203.78.138:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kzdbzklvhncarr\gnygm.rcn	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
668	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1096	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1096	1720	regsvr32.exe	27
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28
PID 1096 wrote to memory of 668	1096	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4_2022-02-24__213827.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4_2022-02-24__213827.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kzdbzklvhncarr\gnygm.rcn"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-59-0x00000000001A0000-0x00000000001C5000-memory.dmp

Download

memory/1096-55-0x0000000075131000-0x0000000075133000-memory.dmp

Download

memory/1096-56-0x00000000002E0000-0x0000000000305000-memory.dmp

Download

memory/1720-54-0x000007FEFBD31000-0x000007FEFBD33000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads