Overview

overview

10

Static

static

emotet_pe_1min

windows10_x64

10

Analysis

  • max time kernel
    74s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    09-06-2022 23:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf.dll

  • Size

    664KB

  • MD5

    945958b58306617cde346d9ed4f8c33c

  • SHA1

    cd25656822e24856692e3ab9c54ccfe18a334f7d

  • SHA256

    ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf

  • SHA512

    9e0c8e9cac1a808849de37d1fc6ca2d82a941eeaeb2772bea61a15429c889e1f798b53e30cf5911fbe846ee73345c79f8a104f2f84211a011883c069f7cec73a

Score
10/10
emotetepoch4bankersuricatatrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

149.56.128.192:443

120.50.40.183:80

160.16.218.63:8080

217.182.25.250:8080

119.193.124.41:7080

103.75.201.2:443

195.201.151.129:8080

131.100.24.231:80

159.65.88.10:8080

1.234.21.73:7080

5.9.116.246:8080

103.75.201.4:443

176.104.106.96:8080

138.185.72.26:8080

212.237.17.99:8080

72.15.201.15:8080

103.43.46.182:443

207.38.84.195:8080

46.55.222.11:443

1.234.2.232:8080
eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\ccb76fc936bef489d1a947e675ec9b3ea9800ddabf7a888c24f4386927a3daaf.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/532-116-0x0000000000000000-mapping.dmp
    Download
  • memory/532-117-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-118-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-119-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-120-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-121-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-122-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-123-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-124-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-125-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-126-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-127-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-128-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-129-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-130-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-131-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-132-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-133-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-134-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-135-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-137-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-136-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-138-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-139-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-140-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-141-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-142-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-143-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-144-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-145-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-146-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-147-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-148-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-149-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-150-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-151-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-152-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-153-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-154-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-155-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-156-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-157-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-158-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-159-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-160-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-161-0x00000000010B0000-0x00000000010D8000-memory.dmp
    Filesize

    160KB

    Download
  • memory/532-164-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-166-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-165-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-167-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-168-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-169-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-170-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-171-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-172-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-173-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-174-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-175-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-176-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-177-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-178-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-179-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/532-180-0x0000000077AC0000-0x0000000077C4E000-memory.dmp
    Filesize

    1.6MB

    Download