emotet | 4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b

General

Target
4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b.dll
Size 996KB
Sample220323-kc6rdaaeb7
SHA256 4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b
MD5 50ab84e4eeb0593e1c0ab1fa38e9870b
SHA1 cb0889503af8e66e85074f8d73d16e72853adb22
SHA512 91042c3c8779f45c55b13b878b67adba0ec6b4b73cdfe3efa0a084b7352372f682dd83c6209f3c199f18f1ae383d1db71de120a25db074551c79ea5784116f7d
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

51.75.33.122:443
186.250.48.5:80
168.119.39.118:443
207.148.81.119:8080
194.9.172.107:8080
139.196.72.155:8080
78.47.204.80:443
159.69.237.188:443
45.71.195.104:8080
54.37.106.167:8080
185.168.130.138:443
37.44.244.177:8080
185.184.25.78:8080
185.148.168.15:8080
128.199.192.135:8080
37.59.209.141:8080
103.41.204.169:8080
185.148.168.220:8080
103.42.58.120:7080
78.46.73.125:443
68.183.93.250:443
190.90.233.66:443
5.56.132.177:8080
62.171.178.147:8080
196.44.98.190:8080
168.197.250.14:80
66.42.57.149:443
59.148.253.194:443
104.131.62.48:8080
191.252.103.16:80
54.37.228.122:443
88.217.172.165:8080
195.77.239.39:8080
116.124.128.206:8080
93.104.209.107:8080
118.98.72.86:443
217.182.143.207:443
87.106.97.83:7080
210.57.209.142:8080
54.38.242.185:443
195.154.146.35:443
203.153.216.46:443
198.199.98.78:8080
85.214.67.203:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006B56F4083 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000003cb41c6f9805177c0ed8c57cd80b8e58b3f98eb85f8c79ffce741c25158031be000000000e80000000020000200000004a01250896543b48b7dea9527377da81aade5dc500fdcc44df23238da043a70580000000e9c8ad2174e7e4f10ba49eb9f03fa86b6cc1a6a5b54d1136ddb39c96ce0e2617474466200c5d5936e0fb4552983de98237205be408ca9911da2ace086aba51921eb08a0c9bae421f1bf5b32b7fed447ace96b5dcdbd471479dea19a611c57b38009853058aced8dba395dbe028e5cfd9094783c5121309e2ce64ac828b0d1f9040000000c1db192ebeb70ef07aab8a7229a9cf3f8718eef0b27cc5332f081da89d9c9a94c5b1d0028ae4ab1d6dc567eac79724d996d04408544b6581b159675d67d50613	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000004e991453ff35ec71f68189ea520359bf532cb571f3d3702e648d90390f13db8a000000000e8000000002000020000000ed785d9bdb2de0270e5862e24451e02c967e672c0201e296015bdf0f19e8357a100d0000c1a084090ed215a06ecec9237504ddee9ee9bf8a27daa1e37d851815b8e33934fc69260043f953b80f99ec052492556d4d670b3fa22661f77e816406c6770730176776055f6f79cacd80a9a1868b9e3a43ea7b3338555d8118fa980e413a73b51e358c3db9c6a897d0953c1c541552827e35af5965349a580c385e317ba48d4fd42cdda00a3acc1f7778b939e304f01932c1506ee4cea63de2ca98be0d540017059b779ba53c7c5f4f3c6153f8ba219b12e68dba8b1791dcec8f8b2cc120afe9636e02707afc85e3c13f8c202660c295d8abd8669444097768be098872be6a32ab5b50514cd030820cde73aca1d337377b587da5b6418e0df49708fd890431d7c1f56d39a7b7647f0bc98f9f4e78416b7e14418bad20616775ded99e8ac65c0cca48c0b88e68fd796db3adab909d544f28b2a4bc060f80fab2957b4c2c96fc880c949d994189a5347964406dcbd33a9c28e65a4aed554482caa0125a31516f4685b8aad5846e10bc629b20503c6811c591ab17ba1c40a66850d94ba02e514bbfc8b27c6057f56c5461c0b24396a3a82858b7a217288c68945287b493a5e50b4630ea31fe7bec44324f9e0a530d87ff20b60e3b3db2a9209738c627e44ce0077ea8f3637742b775c4b5e1b6fba4683480b766cbab094b9294e0b8379ede18c9e4b7926a96577f3355c0f59ea08eea043fea7bbfca603df7768d3758702ac8b6ac51fb35f048284e2f097078419d4736fa60d0e9b60eca0466d6ccbf4155794d1adb18afe3f5dd62d0d4aef146d0fb1d6c5514483bfde22dcfb22cf4fb768aca0f27855d495fead9486b12cc335816a2b83bdf41d75bdcb7174101ffbdd45d13c653a19743becf42df5e00f8262d04f5d254eea9508f39ad62f1c038d9bf36b415af0c50250b8c05c3133cb2459209c129cdf7b7ca8b66bf077a1cb62ae80b8f3b95e2d6c96d0b9dcc43d0b198e5a0c425e9e0800c54aaede8679ab6ad8baea595e312bf1d1c8241b3f8dfc6e720f8ee84ea24beade716f2048abeeddf62437321d7c804a87b3e3249f2ba6b74caac826735cdd667b2c7a356b21dfe53842000c35fc944d83bc42d3cdb4fd1875ca00d548de43eaace81eb23caa156a879fe39d0fd6ef2ba745229673a8ff2a377aa33dbf511a50f916ad5161108e28a43e346a959e4e0e476eba3815d09dcc4ba0e1d5ba4a83146ca3a8e45ff0c963a5a433d8b5a9a531d74b31d9160f46f600d88ef3409f3cbd26db4f60dfd4fb284b263497c17c827437711f66fa5da875ac946d2893aad2288b2a69d63f692787f3e74533e5bedc558c9ab9df1d37ee87cf7cfa987c0be1555ed9b3eb19a52583187d40a0dee7e2ec19960eabba5d1a832dd2c2095965d27dba8259571799490b8f2b5bf398ed1117534029ca5bc5c3980033637ce5b4a27cd7dfa46ac7cc4d954a1700a15e89980276689fff1fecdefc5021abdd823aeb1cbd9ebf040778c6cf842069afd04c35b5be46c85cc0c551af4dc942af8f54ff3b024f10ed973d964398df3b019eebaa92f230ae3a0afd353d775b38d502d7a4a722e7ba5682ba9268991ac7dbf6f714bd219beae96963005742ae1156753a849ff7babaab5ca8cdd1fd6914eeaf335a7a42ea0058703a3cf1fc24aea1c19504c0ca9772618acf7e6fbdac1c24a55d47552cc8feb09b7fd0562d17dce046cbdc1e6e1fd9fe024799d903f7437d422b763e639e0433906b1aaad38aff8fdb0de6fe79e3eaef1aa3a1e121f4544a7e52953ef076b6b112f4800b73a06c49142185f3b4d16a3d89e2b7e7430c3e39287d24c6e39a03752adcaadadc3d5061bf6650cfa3e88e596b1b5291969760e81373b7c5717e9a23d541de5085c5870dd40dbe2d5f86446705df220a56c1972010ac88216b5090e217168a41f6747b89058a8eec1b19f4484db46190f390d7de74f31bb612dc84b28d26f55a0e56e0890e54e5ab4a4d30118e64ff21c465194f72be11839953213677b5380e009431f235df7cc7c9eec9cce31461ab22e678c00bd052a8b929fd40545020dbfc1ed78d9a43ad73747e50236506dd26d9ef6ea9f6041f46bf53cb0eb5356434103d9cf19e4b44fe91c603f3d47c4395424b11b9a9f33fce577387843d9181194012879b8d070defb76170d61d2b161be9fc33136bcb1158da124279ecc5bb3d925323a51aca8602ef0903e10d2941b3956c2ddb009988429d8391c3b4231175b4e969e5077de9eef6d0c7c6ae36b49129d04b1a3940ecca42ad584052ecf5eb71a42e3bfd7b57d14216a51f282bc470beb191f07a83f38e14fd06527c84f8a294d8a079f32c4003a68546e625386dc89b55ab8297403b1d516395d401d9cee4f3e728e0725ff8fef0de3327522d10c50c711568aeb3b760745f9d180d106c9428ed427581e8e8d769d6683bc34b6f8017ac44ddcaa27741be58c9585ce0777ebca33a9f8d2b747f5c2ec039ab3978a55a51e9a8a26144f472e8d69f73aa1f3ba8c0bae4c5f2ce1d015ad00f001b2de24ea431ee6f6407a85b5fecd6fa6d98b393411105df3fd343c56ec33e91c27ceed289f1cc1deb65514e111c7a7f1fc67c78cb8b3f37cfd36aeddcf76236b90ac9589adf474b6d20961b5e2658d9da151839edb31ecd507e99dc82f491a5e6d27b9ddb9cb3512d0ff20acb09a95a16f57d135cc16751a27bd31e9ce00bed21b592c49b0870620f11f94c640ea21b33755676a7c1e968e4dd0c561d732a80c3d4739ab3330b2ff599cffa047086fde04ea14b990d0d9415bd2bd52961c704c9eb768c49559f3ed445f1d07fc4da853aba39f6588b41e0e6c735665f0abe93b85d9c7182923e89a2c23c37cbdfc4d2c747da912871a936e64364d0435347c9bdcd01f619ba2f0b6eb1bb185d679ab17323952f18322f344574a5632c18c4433a3c7cb57117fe917cc9921b3ae747670be4a1c537f02cf2336aa2764a2f600df87e759d15ca9e36dedd99a0120f6bf472325a84aa1ac90fc5cd3f13d63099a32ddda2d86db780ea3a2a4ba2d037069c94a12009812c1f0fb4e6e2c7051e3d86cf1075ef70d9942e94377a81b519e7ecc154135c4b1fcbdb6f732119158e98509aae6fa1910a5960712e4bc67cea48cfd0eeba99b0daab7f00721af373bf849301f2c914a200755da71601601f89c168429a402989d4dbd2030ba5981b09cc9fa8df90876c2f5dae0d9ab1f21afd27c10c26310be080b23d00a9fd4c4f12a418adc060b37a3e3395b6cba1d24d8acbeaf4d9f02b0f769be090cb49127a77755dc6591f0e63b4ecc83bc6eb566dbf538e5f5a7224e93dad6fed63a5cb6d7fdcfbe3e7a310eb4fb265bffd7e7b10b60b3512ada606f597ae864f8d0d20bde9f7f202bad6e1cfdc19344ce35560cddc5ffdd1f24db2ca9030a4f4a4a4a5b69d100b395d06a6477cec172af88358f6967165d2260e5cacad1b2b3fe9b9a113508979ea08082f0b828132687d6e69eec7a63bbad8612c1f3703f814a2e1855842b236a4a8c6d758955d35210f437c9379a3fbb7f7729f86eafdf3eb29cccb304f5c6bd0aa9dd5e930fe611e47099e74389a80273c9cc1a83ce40ed113eb12339b5599a91dca13d82d065bfb7c7ed0d4afc7b773d1c0748ae3fbe72deeb5807806860d8a3e13913d6bf5e80ece0d234a9ad37721d24606abb44b2b01e2eb9c0ae1ec0ef8b628f1e89b16cc7d78d78c7eb2842cae4e145c815edde1f73db40bc6b492239de99839a0e64772c5cbb364aa43b5cc46abb26393caddaafa051b8c2ac817e829707f2e2faf00818609b5f0fbcd8cb12a2464bad77d00e18c1f6f38d8da86a18a5c3d8b956b6922be5f459f46e45220f0a914e12303c2122bb4e915f2bd382d25356222f61ee59e10bcd844ed7894ce41daf0e7c1504126579087623d17ffeff1fadccbcc3db4a54b362c84fe1930eb300b91c35b327d45f809f13589e09ed3dcc7eef4844b33a4b582d3929356f47e48bf4de7ad567ffff86961a93f707fc6b384b4d4415d9e88084bd7f920a8ee41fcf74a6c2504e6d9f4e71e58931fe838ff1889b91447328b39e03925a66e4c1bc4638899b83f546eee3a435a63861390d05c4da5fa86a9906724c6f6131d9bf633fbeebb4b3ac08aed895cad324352a62d524f7e53eeaf819e85316f84c711a748e7832efd79cb6688c9326435c35f0242753f5e51ce9bedd351b7edb72226b61c909db2de292cb11e1aa24ca1473e9b33761dde52d6d01d61d7dc06006123cd7a42f25de8a5afcd7773fa72587a1e11ff061e9aa9b2718cfd0253671573f7eb52bd23ea1c0c9cadeefb3b6b3aba603ba06d4770f25c2e3ff654daf35bfb26a5d44c9aa081afb6fe2121d2a6a6139f37246482c2025262b33570e77942d5833ec6e2fdad349f2439f55269d9ab6f83836b4f97d248b89d2608c7c2316d1859282f01a5800c8cbbefba1cd0d6237927fa7821c76962eb629454cc683a81a496dd9e27769da8115ab3324b38151c11ffa08189e4617586a5ff6c87de740da891ac54b536ace2a7f84485d9ebeb1b4d0e33c57cf23490c1c5efc27e78b3f191ea3a6c377c9dff0d332bac0661393af207209388783fea183656f7cc97623ebc3c323184dfbfa350da9406191aaca5255c2347c6070a9a644f50e0c32df30949af055958dfc333d53d049d55820c45637c9f61859250c7161ddc86e435a73ef21d925a167ce6a1807fe40000000accb4e5203f757f260d5b14308767e37ce34e009a36947d72110a07263177c939806e7000cb0d7d57cc522ae0dbb214f86404478f6e575bb52fcb25a4da500e4	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006B56F4083"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	regsvr32.exe
4328	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4328	3920	regsvr32.exe	82
PID 3920 wrote to memory of 4328	3920	regsvr32.exe	82
PID 3920 wrote to memory of 4328	3920	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4328-135-0x0000000010000000-0x0000000010027000-memory.dmp

Download

Analysis

Sharing