emotet | 09ea10abb87a01f2e657cef68b5410640c402c302c3244a03a4ea503f054121c

General

Target
09ea10abb87a01f2e657cef68b5410640c402c302c3244a03a4ea503f054121c.dll
Size 996KB
Sample220323-kabhfsadc8
SHA256 09ea10abb87a01f2e657cef68b5410640c402c302c3244a03a4ea503f054121c
MD5 a2aa986fdf956e7cff313bdd3ee9a0b7
SHA1 74beb99829e5dc3e8f7b87f6b7e47c0faf8f3add
SHA512 12bed36fa49f4cb28fb5f0ed5c9089cfe24e6f8ddfbf8fd367f7c0787b87eaee8e677084583162377692aa93a1ab744ac5471850a980f0e5d1e0ef6635fefbed
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

51.75.33.122:443
186.250.48.5:80
168.119.39.118:443
207.148.81.119:8080
194.9.172.107:8080
139.196.72.155:8080
78.47.204.80:443
159.69.237.188:443
45.71.195.104:8080
54.37.106.167:8080
185.168.130.138:443
37.44.244.177:8080
185.184.25.78:8080
185.148.168.15:8080
128.199.192.135:8080
37.59.209.141:8080
103.41.204.169:8080
185.148.168.220:8080
103.42.58.120:7080
78.46.73.125:443
68.183.93.250:443
190.90.233.66:443
5.56.132.177:8080
62.171.178.147:8080
196.44.98.190:8080
168.197.250.14:80
66.42.57.149:443
59.148.253.194:443
104.131.62.48:8080
191.252.103.16:80
54.37.228.122:443
88.217.172.165:8080
195.77.239.39:8080
116.124.128.206:8080
93.104.209.107:8080
118.98.72.86:443
217.182.143.207:443
87.106.97.83:7080
210.57.209.142:8080
54.38.242.185:443
195.154.146.35:443
203.153.216.46:443
198.199.98.78:8080
85.214.67.203:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	5000	WerFault.exe	15

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018C005E6F553B7 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000aade5dc500fdcc44df23238da043a7053cb41c6f9805177c0ed8c57cd80b8e58000000000e80000000020000200000004e991453ff35ec71f68189ea4a01250896543b48b7dea9527377da810f13db8a800000002d80eeb83b4665f09bcc732a2e3d3e1ba0911af96c3008587d2321f49847bb54a33b180f82e141cad96cf5b25edc630dc6b4e12f6e26dfb1426266c70f794e148d863b6d93255c75342ad736e507fc262c6d635074b473bdfbf66dc58fa81d2deccf304b664800bbe931e46f564117e1378d3445d5ac0f453c353a094b88dff6400000008e7db469b944a92fd8685d350d314e92ca0b430bd43067cc3af1ba430d4b0c73678f93d8c42433cd62fb95e371940d3c147204d48b3a5e2a493588e860789d4b	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000967e672c0201e296015bdf0f19e8357a5855e794a593958b0dd0ec54520359bf000000000e8000000002000020000000b534ded6a77ad561b54db1353a12ead2ed785d9bdb2de0270e5862e24451e02c100d0000da46f942f10fb3b1fb777841caffc07cfd260b23d2f1874523a88380936f64e1deb99dcdf4626887b72bbb520cf692a67256db81a8ff282505eb622eef0cd4ca18039fb5fdada605c27914231ec69f88a2172a288c7ae29faa2477eb61e2519c71f65c4e5676e66e498c8a9c60ade397065755892f2845469907e2f5c4c4c1d0fdc6cb6d88925f60a51e2e4a3971c2dea2a7ae6b959fd04b3764481376fe23942d945df8f9f5197d25d064d4533b70a678d3b9827923b0a3280a458a6084d15b3dd8832dd175d281759519a492582f01c64cea43c0de83589c16e43cce483681f27206403d2f7502fa9a43bfa3001ca3c9e0762ab498fd256b592ee44ed4944dcb034b1cb94defff95d2b366f96b2bee54c65dd6c34cb85c16e072934adedb224436368b90acd33ce585230c3a7da71079a0783b4ce0e0eccf3ddc4ae89360f80fa4e6f6ab9cb18d1c7cb044bf7a27e5aa4630d0d7bd0d84854aeccd890d7babece03073892ab3c3c2c760928944dd3559dc62e334737e1d888664f115bf68b046d7c5eddc09e631d46c3623b4423ef3d3a781837fd9746ebf1197f66dac2f36a9f2c7797b0faefc0374a667e45c135a87813d09d67052ecca6406f4f719113444ea12fac3106ea31af87a48ca36b1253729c2303fe8c6ffe827a3254b0f673b7d81ffc851bb1bb3ce2dc85156e0e99bf18b08b695115511dfa2ccd85874165561b86997cf0b4ddffb5f2fc715e26e5ce4d41b86e2c4b6e4c76734fe36ce7bb4dbdb646e0d4f71d82c6de92d451c8219263ce2102512314c53600b6354a813b37e70eadade45a61d0392346a151981a868b3dcb3ed49b8c9e7b95a022403e6d3c2f425b716fe93b062b040712f6c745f7785b783ccdfd68387d5c8c03a39ff74c73d2ee06a5585086efa57217101bd3468636d2a13c65d0fef6a7fcff8c67010998f824bb84489fba814bbc339ca168b6a10a7db88639faa11b66424b589aba93ba8d0044a634971a48e1dbf9e6fe16ad19db96a6adde308728bc98ea8b16a28145a790d53c6553e86f276c82f630225349df8b99093f5ac07642a0162c2e6777cc49d2d8d54e55d7cfe5b98ba6a6273fbfc0da439429bdcb52b131670dfa2e9fee61e0a8d66a58b873e84dbdeaebdb371bfa0363a205d1537ba1ee239b2ffa5b2395aa5c6ecac43731842166d618ec882e05bbcabe3a8286d8e99f24e34659aa205dd36413f4ba943f609f50df0a0a401dbd8745b277edd50e7598e8452a2d6a1232d2946984ff5364bff8bf7f07310c58230a1a94a471f98198ba3890d845296b680a7d65e0714b6d6a69aa71f9108082967326e57afda6afa7553f798f942052afac07e99dc5eb3381c485fe0c710db0f25cd0431e7507d260521b51f12a5a5372f44ded5fea41ac9fe3ba78e33c1fbedb426ee90912e722607fb826777bfbe694a24634ee399a642d7a3afbe08fdc67155811f62bde9e4bb01fc2f912956bb58e752002c215886f194a233a21fdd987940ed449bb9684a215feb96ffec6d29c685b2039114d133960e79fed74e3fc7a4566a454191ec12c55fa663d823a1d2eaa843e383e986f662c2c9f97d02e9d01b1210b4129e80a335b8d8b1269135b50b468877ed77fa29bf2f40798ef4514dd520517146fec340fb9fd1d53c50cd109627cbbbbd087648f4582497aa428c202958cfdc7eb650fdfdfc4446c118aa6e76c5dc9a488da360ea988f0eefdfbaf9900373ad203050a6f4f6eb0eda5283397ae883786c1869f9b9605ccb9994584560be27664eaf17d003f20de0f024d7c5a4415a71899225b5d6e4fc2910324b5a945c3ea619f2886f9ede89c403d20adb33c4ef9baf0f9abc7ee0a8e6a475546b61cac6031fb236de5e5929255e42ec114386630494153c2996f512d4d94b68231cef56f3c3775ecf59a106dece0c95ba89c1923d39b18ff35a8b638074a8dfa05b8d53a691ede068c85ccd1fef9e839f66835ea4f8b8ef2abae8f111d93e7043411f4f6676f434b2fbf0f5b0c6271f28c2116d7abea0265e3c66888cd02c6414d7fa05290d9bf8f105aac613abaa6b016727c784d4661a106396fe545c0618355a11ca8657c919741be1667ca56be65c7db04c55e46faacf90c602465c3aa7fd20be5e09f1348bc3a1603553ee92547ce4493f0a01d9555941db31aabb747846b69e08835339b69cbc2a113aa2ce25b74c08d72886d637eb084516f070f283206ad228272b9aea91b4651b72f71e9257e2840571345497c41968452e8e373e11978ec9d39666bca675b3d3bd1cc73ed2e3273280502b739c0626bdc1296337b89e58749d866a963f20d1322ea71b6884d492b3a731a2bd2d90015b16594eaf1386f83c0746eb3a9eb3fd41af7ec97026d9eeda88dc73077f06c85d7c5c4b89691b442f8c8c6a5246ca87ffadd9a3e137bea4839f4929b28323010d5614411273ffb2209c92b7d13861bf50c52e143cf44547330a4aa3d31c00679a3e4eb9e5923bc3f6dae5bf7448ba578228f6783eba202a41fea70e7854809cc547b5ec4efdc17aa4be52a13c007b748611f7171aa9cd22e95d0797a090b0964d2a90f22bdb5373384e280325905c07098670781ab4c9fc7a2d5f08c3559c2d8f51536cbd34293a077a4f50a8945169f3b7bb1766fdcc104720f38c76cc8600006104bd6b65ff9684d97ad5f0d268a34d32813400e190ad16395781a3367be6c55ba0209947dcde4334e53ef9c1d130c133df52b9373a8191064348761763fb1149c8331102348731b1db9f42fb6c8418e00fa1b8e0714b8643df867563efc2d1d9bc6a839de1d48032ca9e9ef06b06518716a5ac95bfa7ccce09bc85a0533d5657158c75254a6b71e1870e21a8f450daa1c11ba5cced5471d9df03e514a6f30493dc2e91267f5ad249d0b665d17c8748f98e45141b902adf269cd945938dfc25b73fe464fb4dbfd6c9ab91c8c62149b87d177ed925d4e366a25f35027fa4727b104b77a71fde7ddff6bdb2449831a66fee78cf6d71d314cf85aae4922d8026a1c61e1a82fa9dc185a5c2ecdf5eaffb5206528fb8a2ef32c76491484f81d4755647d2a727ac6cf4b8fef03a4c569f5c160855a0f5c81b9ae45aa56b3e5c050d1bb09a78d236900fdda02c731eb170fb6033e9e2c363ed79901471ff0b32fcd53681999019e289c465e30e7800c5dfa2e2d71b9e99f96cfdb649f05d77203244344569fdad8c5a56a81717badfb7200cd5af33ffe5c6bdd9cdba4e9c55e925d63892e2b7a5f0a5bcfe411c102a34469c1fd518400d0f04cbb3491bc40a784a6ea63079de48e459904a7c6a2ba8d3a97eaaeff25e53a019f1f2463df878d7509784fb57ce6e10ca5731282cddd08ef1bdbc5040a151f0a9965a2d555de57b00b886fbd040f35ee2294099894e2a5c39f72860493b4f564907e4446103c62b6e927e281cb509978e9e59f8b90ab5daafd9ccc149766f317c5b023a2ed4fd32ea1d4165815bb2d2165947db77e641070303fe0cf2fbb7305c0b79b3807da7c93428be6c33466ba8e6da6eb94de3db88943696ea148921073360ee63901d5f974b67ef1043916d21ac37f9cbf38aedf736cbefc0bef027e84cefaa2b8986a290f297d142759f78f0a7e6c3f10cd247361c06f974a7302d13cbeb4610f94f0f6f81d3ce70ace40c3a7317fc2bd6a13160862026412816e4e383a0bd7c4d76dcb41390d39a066783b6cf4b6d9a2c0ac2d3a1a407f783f54354d5fad16c67c0c29781401132d4a8a3dd66d427987325802a1f462306a1c1aeb1557ef1951fdb0d4ab705604eff5a73fdeb295d882fad2fbbf36ac36057426fd646c5602bd6f0b612b2dedcf00cf259f990d2e6d3bc15075ed16523f684b4d71bb8493024a169a79e49c966b29b76f5dba8f29d84590db4edb28441bb0247434acdc3ea387a51a1e6be54dde07f375b774fbcf2d7efc54637fb2343d84089d7772b16dcacf50c4ef4329cc194c2534d046b9c9c59b8f57ff247b5805b68bc69a5d9bbc676243f29dd0ff7d7e4ad8a7f8792f7bbbb9137eac24d0027332250824f1463b99c1de1ac454d963155cf433bff50012730335512be3418ab9723d43fb40105ada3b1702194f989d7e6c1d610b609f1dc60458413d1f77e98259f7ff2e141203d40f8a7d50e468a47d8ff1a455cd6a393f16ac85c2e6c3ebe560fd8ac416e3070889a1f55cb7f79211cd3cf563d3fd3a1094cb5eed5d4df4fd75833916b2e3a6efa2701418a90a09014056ec72fcd92e4f8edf8bf36c22741d7363e4a0ff3ebca4e0dda84c40237c6a99e58d962b771af04638ca3388369c8055449aed281e4439e13d903ec5056d1e7d8d9eac14aae21cc70e501daf8b4b255d9f4778c0c0875e1412bb2a5ffabcf25de51d486724cd36bcd00b2649e788462b2966c27fa5b1de0b88d9acf93447b1e3057e724f64b551c3e579b9e1b2091b89257f06e37523a7ce56a5990cd11baa12eb07dfb97ed7992a6b53b11fb3516b0a6aa8902c582007db724560b48f64395d82a3d47d59819faefeccdb6b87beb009ce2dadcbfdf273b9f954736e343a22f8a16974195a26d1d9850ab104f27618133525bfa468909763ebb956252aa68b72fee19d6561e00a3a3b148d49fadf34baf2721d86977052f5e1f7808cb84d9ec121ec99b1d923ed0d2c12fd4cf567900839a9426308edc2b3d8a70eb31192353b125a640000000b66bd5849e8cb8eb28f6c91c644747f046c37c4bdfd040e8f5af9b2b1112c2e396d215ec0d910643ebe8d8fe9aa6461f9cccb08843b27a68cf976e7190e4eb5a	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018C005E6F553B7"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1720	regsvr32.exe
1720	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1720	828	regsvr32.exe	81
PID 828 wrote to memory of 1720	828	regsvr32.exe	81
PID 828 wrote to memory of 1720	828	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\09ea10abb87a01f2e657cef68b5410640c402c302c3244a03a4ea503f054121c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\09ea10abb87a01f2e657cef68b5410640c402c302c3244a03a4ea503f054121c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:976

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 5000 -ip 5000
1⤵
PID:384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5000 -s 844
1⤵
- Program crash
PID:4004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-135-0x0000000010000000-0x0000000010027000-memory.dmp

Download

Analysis

Sharing