emotet | 12f6c701e3066a2e4eda1eae43d6d9e7a9f12cac779572f33f2e219a83ae6058

Analysis

max time kernel
102s
max time network
64s
platform
windows10_x64
resource
win10-20220414-en
submitted
03-06-2022 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12f6c701e3066a2e4eda1eae43d6d9e7a9f12cac779572f33f2e219a83ae6058.dll
Size

578KB
MD5

ba3df5ab562b0c2dfe99dc9353f8593a
SHA1

52ee76db4db5c5691f5d14052231405c8af44c34
SHA256

12f6c701e3066a2e4eda1eae43d6d9e7a9f12cac779572f33f2e219a83ae6058
SHA512

ad48a54d607acad5b6af267992070c182e91b19c58a850277c921c0cee6bc460314340577116f7015573f5060198907bd1417193eebd0c608881fc66a546096a

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080

146.59.226.45:443

51.91.76.89:8080

209.97.163.214:443

158.69.222.101:443

82.165.152.127:8080

103.70.28.102:8080

72.15.201.15:8080

150.95.66.124:8080

45.176.232.124:443

82.223.21.224:8080

107.170.39.149:8080

160.16.142.56:8080

103.132.242.26:8080

153.126.146.25:7080

213.241.20.155:443

1.234.21.73:7080

197.242.150.244:8080

188.44.20.25:443

196.218.30.83:443

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3932	regsvr32.exe
3932	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3932	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4332	3932	regsvr32.exe	68
PID 3932 wrote to memory of 4332	3932	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\12f6c701e3066a2e4eda1eae43d6d9e7a9f12cac779572f33f2e219a83ae6058.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CHiTL\ZEYjwFd.dll"
  2⤵
  PID:4332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3932-117-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download
memory/4332-123-0x0000000002110000-0x00000000021B1000-memory.dmp

Filesize
644KB

Download