emotet | a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd

Target

e4-5375ff373df38f4dde8f1b1dbcb3b31b.dll
Size

418KB
MD5

5375ff373df38f4dde8f1b1dbcb3b31b
SHA1

8ce588d597c71834e5c7dc15ab1edfeca579e4ea
SHA256

a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd
SHA512

886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

138.197.147.101:443

134.195.212.50:7080

104.168.154.79:8080

149.56.131.28:8080

187.84.80.182:443

158.69.222.101:443

91.207.28.33:8080

5.9.116.246:8080

103.70.28.102:8080

153.126.146.25:7080

189.126.111.200:7080

110.232.117.186:8080

167.99.115.35:8080

146.59.226.45:443

201.94.166.162:443

103.43.46.182:443

103.132.242.26:8080

185.4.135.165:8080

159.65.88.10:8080

1.234.21.73:7080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1776 regsvr32.exe
Drops file in System32 directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\system32\Fszfcrtjrkb\mjbfxricrlpwe.fhj regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1776 regsvr32.exe
1776 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

4480 regsvr32.exe

pid	process
1776	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\system32\Fszfcrtjrkb\mjbfxricrlpwe.fhj	regsvr32.exe

pid	process
1776	regsvr32.exe
1776	regsvr32.exe

pid	process
4480	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4480 wrote to memory of 1776	4480	regsvr32.exe	regsvr32.exe
PID 4480 wrote to memory of 1776	4480	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4-5375ff373df38f4dde8f1b1dbcb3b31b.dll
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Fszfcrtjrkb\mjbfxricrlpwe.fhj"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Fszfcrtjrkb\mjbfxricrlpwe.fhj

Filesize
418KB

MD5
5375ff373df38f4dde8f1b1dbcb3b31b

SHA1
8ce588d597c71834e5c7dc15ab1edfeca579e4ea

SHA256
a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd

SHA512
886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51

Download Submit
memory/1776-134-0x0000000000000000-mapping.dmp

Download
memory/4480-130-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download