emotet | c9861e9389cdeee996d5a4a75468123649c7007eda719e125177b016ae583f85

Analysis

max time kernel
104s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
08/03/2022, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a79acc44cd5cc9f10f8bcfc34fdeaf1e.dll
Size

790KB
MD5

a79acc44cd5cc9f10f8bcfc34fdeaf1e
SHA1

23e8a0a926d27dcccea0273ea45ab49a17ca0266
SHA256

c9861e9389cdeee996d5a4a75468123649c7007eda719e125177b016ae583f85
SHA512

af0a16852fde2aa6cb75b0b14da8979fc28ca01a14ab01ef6556048fd5439299c4a4d2cfc8521dfd90c89846912f51460e403b57688746503b8d19f8d347fdbc

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

51.75.33.122:443

186.250.48.5:80

168.119.39.118:443

207.148.81.119:8080

194.9.172.107:8080

139.196.72.155:8080

78.47.204.80:443

159.69.237.188:443

45.71.195.104:8080

54.37.106.167:8080

185.168.130.138:443

37.44.244.177:8080

185.184.25.78:8080

185.148.168.15:8080

128.199.192.135:8080

37.59.209.141:8080

103.41.204.169:8080

185.148.168.220:8080

103.42.58.120:7080

78.46.73.125:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	regsvr32.exe
456	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 456	3716	regsvr32.exe	55
PID 3716 wrote to memory of 456	3716	regsvr32.exe	55
PID 3716 wrote to memory of 456	3716	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a79acc44cd5cc9f10f8bcfc34fdeaf1e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a79acc44cd5cc9f10f8bcfc34fdeaf1e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-130-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download