emotet | ad445d94c9da99f5bb2af66738b92045cae2f3972583daf07d2cd3820dc89d26

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20220331-en
submitted
31/03/2022, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98ed940fefbc527d6c38a41158e6d591.dll
Size 704KB
Sample220331-xwgmtagga3
SHA256 ad445d94c9da99f5bb2af66738b92045cae2f3972583daf07d2cd3820dc89d26
MD5 98ed940fefbc527d6c38a41158e6d591
SHA1 1406d3ba312b4383f60c1a081a8736d1396d7287
SHA512 f726cf2aa62abe470d34b8d8144f5f5a553d7a2ccedb5877995ca6f754aeacb88eee8812c8f9987cc62eb9d9f005b69747cfd39089eb39925a585fc46de5ee48
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

5.189.160.61:443
94.177.178.26:8080
202.29.239.162:443
54.38.143.246:7080
119.59.125.140:8080
185.148.168.15:8080
188.166.229.148:443
2.58.16.87:8080
104.131.62.48:8080
103.82.248.59:7080
37.59.209.141:8080
103.133.214.242:8080
195.77.239.39:8080
128.199.192.135:8080
78.47.204.80:443
59.148.253.194:443
87.106.97.83:7080
45.71.195.104:8080
85.214.67.203:8080
139.196.72.155:8080
210.57.209.142:8080
194.9.172.107:8080
116.124.128.206:8080
118.98.72.86:443
203.153.216.46:443
202.28.34.99:8080
54.37.228.122:443
202.134.4.210:7080
88.217.172.165:8080
196.44.98.190:8080
195.154.146.35:443
217.182.143.207:443
36.67.23.59:443
207.148.81.119:8080
190.90.233.66:443
66.42.57.149:443
85.25.120.45:8080
93.104.209.107:8080
68.183.93.250:443
103.42.58.120:7080
5.56.132.177:8080
159.69.237.188:443
51.68.141.164:8080
54.37.106.167:8080
198.199.98.78:8080
54.38.242.185:443
62.171.178.147:8080
37.44.244.177:8080
103.41.204.169:8080
78.46.73.125:443
185.148.168.220:8080
191.252.103.16:80
175.126.176.79:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Executes dropped EXE 1 IoCs

pid	Process
1676	lslusjulicl.exe

Loads dropped DLL 8 IoCs

pid	Process
2028	regsvr32.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Vbyftnltnsf\ojggaahvmuoabj.edu	regsvr32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1676	2028	regsvr32.exe	38

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	1676	WerFault.exe	38

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
268	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1876	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	regsvr32.exe
2028	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
532	regsvr32.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 760 wrote to memory of 532	760	regsvr32.exe	28
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 532 wrote to memory of 2028	532	regsvr32.exe	29
PID 2028 wrote to memory of 1876	2028	regsvr32.exe	31
PID 2028 wrote to memory of 1876	2028	regsvr32.exe	31
PID 2028 wrote to memory of 1876	2028	regsvr32.exe	31
PID 2028 wrote to memory of 1876	2028	regsvr32.exe	31
PID 2028 wrote to memory of 268	2028	regsvr32.exe	35
PID 2028 wrote to memory of 268	2028	regsvr32.exe	35
PID 2028 wrote to memory of 268	2028	regsvr32.exe	35
PID 2028 wrote to memory of 268	2028	regsvr32.exe	35
PID 2028 wrote to memory of 1676	2028	regsvr32.exe	38
PID 2028 wrote to memory of 1676	2028	regsvr32.exe	38
PID 2028 wrote to memory of 1676	2028	regsvr32.exe	38
PID 2028 wrote to memory of 1676	2028	regsvr32.exe	38
PID 2028 wrote to memory of 1676	2028	regsvr32.exe	38
PID 1676 wrote to memory of 1620	1676	lslusjulicl.exe	39
PID 1676 wrote to memory of 1620	1676	lslusjulicl.exe	39
PID 1676 wrote to memory of 1620	1676	lslusjulicl.exe	39
PID 1676 wrote to memory of 1620	1676	lslusjulicl.exe	39

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\98ed940fefbc527d6c38a41158e6d591.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\98ed940fefbc527d6c38a41158e6d591.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Vbyftnltnsf\ojggaahvmuoabj.edu"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1876
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:268
  - - C:\Users\Admin\AppData\Local\Temp\lslusjulicl.exe
      "C:\Users\Admin\AppData\Local\Temp\\lslusjulicl.exe" /scomma "C:\Users\Admin\AppData\Local\Temp\6476.tmp"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 36
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lslusjulicl.exe

Path C:\Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lslusjulicl.exe

Path \Users\Admin\AppData\Local\Temp\lslusjulicl.exe
Size 869KB
SHA256 589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4
MD5 7b973145f7e1b59330ca4dd1f86b3d55
SHA1 10ce9174bff4856083e6adad0094a798ced2c079
SHA512 1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4
SSDEEP 24576:gLByfEWXrGU3Vrzll/POE7gLtk+oOg3uOvb725m:gV+iU3j7chk+w39z79
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-57-0x0000000000270000-0x0000000000293000-memory.dmp

Download

memory/532-56-0x00000000769E1000-0x00000000769E3000-memory.dmp

Download

memory/760-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Download

memory/1676-70-0x0000000000570000-0x00000000005CE000-memory.dmp

Download

memory/1676-72-0x0000000000570000-0x00000000005CE000-memory.dmp

Download

memory/2028-66-0x0000000001F30000-0x0000000001F46000-memory.dmp

Download

memory/2028-62-0x0000000000280000-0x00000000002A3000-memory.dmp

Download

memory/2028-82-0x0000000002820000-0x0000000002894000-memory.dmp

Download