emotet | 30b9b539e41b7d36cd1cd290b4b09ecc14522c62d1c691ebdbbf13bc8caa25e4

Analysis

max time kernel
54s
max time network
142s
platform
windows10_x64
resource
win10-20220414-en
submitted
17-05-2022 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b9b539e41b7d36cd1cd290b4b09ecc14522c62d1c691ebdbbf13bc8caa25e4.dll
Size

416KB
MD5

ae3ac897e46b7b022f6e770c15f835d9
SHA1

05afb8eccbd859b4bd9ddce558af155c526d73b1
SHA256

30b9b539e41b7d36cd1cd290b4b09ecc14522c62d1c691ebdbbf13bc8caa25e4
SHA512

aeb59e55f0d25aadfea286ec50b013945a7811c559dbe3720edf8f80c8d92c5733a370d07e38b033997540ac6bf5410d8cf3758b50167a99fbb12904c5a8b838

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

45.118.115.99:8080

189.126.111.200:7080

79.137.35.198:8080

103.43.46.182:443

102.222.215.74:443

103.70.28.102:8080

196.218.30.83:443

146.59.226.45:443

5.9.116.246:8080

164.68.99.3:8080

163.44.196.120:8080

167.99.115.35:8080

209.250.246.206:443

183.111.227.137:8080

46.55.222.11:443

45.235.8.30:8080

51.91.76.89:8080

107.182.225.142:8080

103.132.242.26:8080

45.176.232.124:443

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3532 regsvr32.exe
3532 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3276 regsvr32.exe

pid	process
3532	regsvr32.exe
3532	regsvr32.exe

pid	process
3276	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3276 wrote to memory of 3532	3276	regsvr32.exe	regsvr32.exe
PID 3276 wrote to memory of 3532	3276	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\30b9b539e41b7d36cd1cd290b4b09ecc14522c62d1c691ebdbbf13bc8caa25e4.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3276

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NrRuN\PCSkYjZgMrbiDL.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-118-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/3532-123-0x0000000000000000-mapping.dmp

Download