emotet | 6bf899647a3d4e3f113b2328c3319df82fb3b9c0530e7776df8f1dc7587dcbeb

General

Target
emotet_exe_e5_6bf899647a3d4e3f113b2328c3319df82fb3b9c0530e7776df8f1dc7587dcbeb_2022-02-26__000456.dll
Size 924KB
Sample220226-ac87dsafgp
SHA256 6bf899647a3d4e3f113b2328c3319df82fb3b9c0530e7776df8f1dc7587dcbeb
MD5 46aaa8308ddb23c588a02bb9a413b3f8
SHA1 f706c771e1082ce85e06d43cde6ba8335b18268c
SHA512 99043362f509308656fbc63a72f162bf3bb7107a9b7dbb8ac6286cd24bfaa830c2667cf541ed7ae75ace951f801826d225efc7d2f451959204489c91929e1107
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

45.79.80.198:443
185.168.130.138:443
185.244.166.137:8080
61.7.231.229:443
185.148.168.15:8080
203.153.216.46:443
116.124.128.206:8080
128.199.192.135:8080
61.7.231.226:443
190.90.233.66:443
185.184.25.78:8080
78.46.73.125:443
118.98.72.86:443
195.154.146.35:443
139.196.72.155:8080
159.69.237.188:443
194.9.172.107:8080
62.171.178.147:8080
198.199.98.78:8080
217.182.143.207:443
78.47.204.80:443
45.71.195.104:8080
54.38.242.185:443
210.57.209.142:8080
85.214.67.203:8080
103.41.204.169:8080
54.37.228.122:443
66.42.57.149:443
68.183.93.250:443
207.148.81.119:8080
59.148.253.194:443
93.104.209.107:8080
54.37.106.167:8080
37.59.209.141:8080
168.197.250.14:80
104.131.62.48:8080
87.106.97.83:7080
191.252.103.16:80
37.44.244.177:8080
195.77.239.39:8080
185.148.168.220:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tywsyevrgm\lhdy.hiw	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1984	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1984	1788	regsvr32.exe	27
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28
PID 1984 wrote to memory of 1504	1984	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bf899647a3d4e3f113b2328c3319df82fb3b9c0530e7776df8f1dc7587dcbeb_2022-02-26__000456.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bf899647a3d4e3f113b2328c3319df82fb3b9c0530e7776df8f1dc7587dcbeb_2022-02-26__000456.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Tywsyevrgm\lhdy.hiw"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-59-0x0000000000240000-0x0000000000267000-memory.dmp

Download

memory/1788-54-0x000007FEFB981000-0x000007FEFB983000-memory.dmp

Download

memory/1984-55-0x0000000075251000-0x0000000075253000-memory.dmp

Download

memory/1984-56-0x0000000000130000-0x0000000000157000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads