emotet | 88395f3641356f8d8d36fc9c517f7559a53e16987b1560b37cb0eea5b300fdd1

Analysis

max time kernel
82s
max time network
150s
platform
windows10_x64
resource
win10-20220414-en
submitted
16-05-2022 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88395f3641356f8d8d36fc9c517f7559a53e16987b1560b37cb0eea5b300fdd1.dll
Size

787KB
MD5

9460f1d838c8f2e54f85402f9d692d84
SHA1

d91d0c62bd7edf237139892b02c0561c61486966
SHA256

88395f3641356f8d8d36fc9c517f7559a53e16987b1560b37cb0eea5b300fdd1
SHA512

dd55f35fd63cbd7bd617ba4042339461905b4dab60b1ce66c51381489fb1431c709aa6cbb555c5a9857c84d57490835ac51a340596af8f7584da3e89fdfe0042

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

93.104.209.107:8080

195.154.146.35:443

202.134.4.210:7080

17.20.148.183:8907

185.148.168.220:8080

68.183.93.250:443

175.126.176.79:8080

77.31.27.120:26351

203.153.216.46:443

202.28.34.99:8080

210.57.209.142:8080

18.229.236.50:18850

36.67.23.59:443

159.69.237.188:443

107.22.159.198:7774

207.148.81.119:8080

54.38.143.246:7080

45.71.195.104:8080

108.159.107.249:48268

45.230.140.156:22366

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	regsvr32.exe
3972	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2236	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3972	2236	regsvr32.exe	66
PID 2236 wrote to memory of 3972	2236	regsvr32.exe	66

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88395f3641356f8d8d36fc9c517f7559a53e16987b1560b37cb0eea5b300fdd1.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VtNrpRtX\cIujlCsXOMFj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-114-0x0000000180000000-0x0000000180032000-memory.dmp

Filesize
200KB

Download