emotet | 8756e7b402fdb2531e818814bf4a363f75084a280c088a0fabaa4b728005223f

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8756e7b402fdb2531e818814bf4a363f75084a280c088a0fabaa4b728005223f.dll
Size

516KB
MD5

611ef5218182c122396d948a74646e35
SHA1

ee9ebdfa0ed288cbc202727f455ec01bd6bcb05b
SHA256

8756e7b402fdb2531e818814bf4a363f75084a280c088a0fabaa4b728005223f
SHA512

3c0952710d0dd2d4a31d897212de90b45265f474ff006ec66daf124e25034cfc7b2c93df74daa55743a5e866ae8a4c29899d75b76a390a941fb44e77f99e4800
SSDEEP

6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXjn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXj

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1504 regsvr32.exe
1400 regsvr32.exe
1400 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1504 regsvr32.exe

pid	process
1504	regsvr32.exe
1400	regsvr32.exe
1400	regsvr32.exe

pid	process
1504	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1504 wrote to memory of 1400	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1400	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1400	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1400	1504	regsvr32.exe	regsvr32.exe
PID 1504 wrote to memory of 1400	1504	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8756e7b402fdb2531e818814bf4a363f75084a280c088a0fabaa4b728005223f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Kenfqd\ZwfOKCEdRyir.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-58-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download