emotet | 1d0e52098565a050900abc975653c08183475f83ef4ce6feeb2a66cbf6070ada

General

Target
a56996951afb07a28581e3bebbf18a5c.dll
Size 780KB
Sample220321-k7bvgsagg2
SHA256 1d0e52098565a050900abc975653c08183475f83ef4ce6feeb2a66cbf6070ada
MD5 a56996951afb07a28581e3bebbf18a5c
SHA1 b339e82d8ed90eaa86293a11334b27738bfd1e77
SHA512 fce6d50233b97f8295090e44c63a8600d6bdc6b26d82bfb30b3db67370bac2679ed3fdcd60f00a5c42a8134d1566b68b378267a7edfc8bd8552177b5abd7c403
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

80.211.107.116:8080
188.166.229.148:443
121.78.112.42:8080
185.148.168.15:8080
210.57.209.142:8080
194.9.172.107:8080
139.196.72.155:8080
128.199.192.135:8080
62.171.178.147:8080
103.133.214.242:8080
104.131.62.48:8080
103.41.204.169:8080
54.37.106.167:8080
217.182.143.207:443
185.148.168.220:8080
202.134.4.210:7080
198.199.98.78:8080
5.56.132.177:8080
66.42.57.149:443
78.46.73.125:443
191.252.103.16:80
54.37.228.122:443
88.217.172.165:8080
190.90.233.66:443
68.183.93.250:443
85.25.120.45:8080
78.47.204.80:443
93.104.209.107:8080
37.59.209.141:8080
159.69.237.188:443
207.148.81.119:8080
185.168.130.138:443
87.106.97.83:7080
45.71.195.104:8080
196.44.98.190:8080
195.77.239.39:8080
36.67.23.59:443
103.82.248.59:7080
203.153.216.46:443
37.44.244.177:8080
116.124.128.206:8080
2.58.16.87:8080
202.28.34.99:8080
118.98.72.86:443
59.148.253.194:443
54.38.242.185:443
85.214.67.203:8080
195.154.146.35:443
103.42.58.120:7080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT10BD.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8=	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT11F6.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT4F7D.tmp	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT503A.tmp	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4176	regsvr32.exe
4176	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 4176	712	regsvr32.exe	83
PID 712 wrote to memory of 4176	712	regsvr32.exe	83
PID 712 wrote to memory of 4176	712	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a56996951afb07a28581e3bebbf18a5c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a56996951afb07a28581e3bebbf18a5c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Drops file in Windows directory
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4176-134-0x00000000011A0000-0x00000000011C7000-memory.dmp

Download

memory/4740-137-0x000001FBE2160000-0x000001FBE2170000-memory.dmp

Download

memory/4740-138-0x000001FBE21C0000-0x000001FBE21D0000-memory.dmp

Download

memory/4740-139-0x000001FBE4750000-0x000001FBE4754000-memory.dmp

Download

memory/4740-140-0x000001FBE4B00000-0x000001FBE4B04000-memory.dmp

Download

memory/4740-141-0x000001FBE4B00000-0x000001FBE4B04000-memory.dmp

Download

memory/4740-142-0x000001FBE4BB0000-0x000001FBE4BB4000-memory.dmp

Download

memory/4740-143-0x000001FBE4BB0000-0x000001FBE4BB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads