emotet | 4de81244f2b723e3ca7c90fa59e2921cf7676e6e46344db26c5b93c2b160bb93

Analysis

max time kernel
53s
max time network
135s
platform
windows10_x64
resource
win10-20220414-en
submitted
01-07-2022 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4de81244f2b723e3ca7c90fa59e2921cf7676e6e46344db26c5b93c2b160bb93.dll
Size

723KB
MD5

17e72adb3250f6be7e0025b3f76a5cd1
SHA1

d1139e800a34d8483dae356fc2d0a180faa8fa67
SHA256

4de81244f2b723e3ca7c90fa59e2921cf7676e6e46344db26c5b93c2b160bb93
SHA512

9c033683962cb7d46db7e45fd04738033a2eb030e7cc9477dd199ba68cd70815621be4164159fc61073ef63194ab5bcb7395191d9197f3da11d3c9cb66f87a28

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

82.223.21.224:8080

173.212.193.249:8080

82.165.152.127:8080

151.106.112.196:8080

160.16.142.56:8080

163.44.196.120:8080

103.70.28.102:8080

164.68.99.3:8080

51.161.73.194:443

146.59.226.45:443

104.168.155.143:8080

101.50.0.91:8080

94.23.45.86:4143

167.172.253.162:8080

5.9.116.246:8080

185.4.135.165:8080

159.65.140.115:443

212.24.98.99:8080

209.97.163.214:443

206.189.28.199:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4688 regsvr32.exe
4688 regsvr32.exe
4920 regsvr32.exe
4920 regsvr32.exe
4920 regsvr32.exe
4920 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

4688 regsvr32.exe

pid	process
4688	regsvr32.exe
4688	regsvr32.exe
4920	regsvr32.exe
4920	regsvr32.exe
4920	regsvr32.exe
4920	regsvr32.exe

pid	process
4688	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4688 wrote to memory of 4920	4688	regsvr32.exe	regsvr32.exe
PID 4688 wrote to memory of 4920	4688	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4de81244f2b723e3ca7c90fa59e2921cf7676e6e46344db26c5b93c2b160bb93.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TaYCbFtj\aBOY.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4688-117-0x00000000027A0000-0x0000000002823000-memory.dmp

Filesize
524KB

Download
memory/4920-123-0x0000000000000000-mapping.dmp

Download