emotet | 1b471f783e22bfccd9c40250b481b1225a8cdc638d064e247fdbf747339ff58a

Analysis

max time kernel
73s
max time network
173s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-06-2022 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wwltjwsh.dll
Size

356KB
MD5

e07d59152703de6dc88ad30c6557512b
SHA1

d5eb69d2155382d4bd8e3055670c6553919f1fe4
SHA256

1b471f783e22bfccd9c40250b481b1225a8cdc638d064e247fdbf747339ff58a
SHA512

413bc240b3e90409c7664adefc718469b2f22949fb2d597987b1f2592505f1bd63b7d3f0a0774b37ff2c00620794a037a2a95357e0442671bcf79cac357fbbaa

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

212.24.98.99:8080

51.91.76.89:8080

94.23.45.86:4143

101.50.0.91:8080

103.43.75.120:443

212.237.17.99:8080

158.69.222.101:443

51.254.140.238:7080

1.234.2.232:8080

91.207.28.33:8080

167.172.253.162:8080

45.235.8.30:8080

115.68.227.76:8080

134.122.66.193:8080

89.29.244.7:443

197.242.150.244:8080

164.68.99.3:8080

5.9.116.246:8080

1.234.21.73:7080

131.100.24.231:80

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

900 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

844 regsvr32.exe

pid	process
900	regsvr32.exe

pid	process
844	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 844 wrote to memory of 900	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 900	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 900	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 900	844	regsvr32.exe	regsvr32.exe
PID 844 wrote to memory of 900	844	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wwltjwsh.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BOQzcnjLfyDG\wBsxLt.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/844-55-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/900-58-0x0000000000000000-mapping.dmp

Download