emotet | f46c1a7127796e584f80083bcad72ccf4aa7de00f73269e4c8846c2f56169289

Analysis

max time kernel
42s
max time network
151s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f46c1a7127796e584f80083bcad72ccf4aa7de00f73269e4c8846c2f56169289.dll
Size

425KB
MD5

2a265b96ac0cbb20380d606fe3f1b213
SHA1

46ab84dfb5c8e372455606b864cb912ef6aebede
SHA256

f46c1a7127796e584f80083bcad72ccf4aa7de00f73269e4c8846c2f56169289
SHA512

8025de18d81002a42273834c6b3cee18a2428b2676242d30fe483225ce7a7b1023778c5f3830b3c6a56e34f56be6e37ccc61f10d84d080b577d57534d43f9858

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1948 regsvr32.exe
1392 regsvr32.exe
1392 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1948 regsvr32.exe

pid	process
1948	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe

pid	process
1948	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1392	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1392	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1392	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1392	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1392	1948	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f46c1a7127796e584f80083bcad72ccf4aa7de00f73269e4c8846c2f56169289.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DjqAlkPBwaNFgT\YFYgQeFSIlUOj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-59-0x0000000000000000-mapping.dmp

Download
memory/1948-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x0000000000520000-0x0000000000574000-memory.dmp

Filesize
336KB

Download