emotet | 17145e8f9b5b9520ead77ef9ae5212b31c36eaf91a41aac59dd72b524b92ebeb

Analysis

max time kernel
294s
max time network
299s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5-a2856eb1ec342202c683d90e92176506.dll
Size

591KB
MD5

a2856eb1ec342202c683d90e92176506
SHA1

bad23944247d3da45c30f2ae7070abdac2fee589
SHA256

17145e8f9b5b9520ead77ef9ae5212b31c36eaf91a41aac59dd72b524b92ebeb
SHA512

4227ab82e33c6ce13cce457fd17bb5d7b9d85723fba2ae219b90f359f24d371f58d4676ac7d88df1035490e0f078ce32c0f7ab63f45717c9ac352476acf136ff
SSDEEP

6144:zKUMJfdFqzj/HwBjCwruDr3XEkRj0PKXa4m9WhkIaORowoHsODjFb84v:NMJfd0H/6Yr3XERPKXaWCIaOaMOlw4v

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1960 regsvr32.exe
980 regsvr32.exe
980 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1960 regsvr32.exe

pid	process
1960	regsvr32.exe
980	regsvr32.exe
980	regsvr32.exe

pid	process
1960	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1960 wrote to memory of 980	1960	regsvr32.exe	regsvr32.exe
PID 1960 wrote to memory of 980	1960	regsvr32.exe	regsvr32.exe
PID 1960 wrote to memory of 980	1960	regsvr32.exe	regsvr32.exe
PID 1960 wrote to memory of 980	1960	regsvr32.exe	regsvr32.exe
PID 1960 wrote to memory of 980	1960	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5-a2856eb1ec342202c683d90e92176506.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RPsWOqrMvxZkaZgk\yzDXYFSOrWC.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-58-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x00000000005E0000-0x000000000060E000-memory.dmp

Filesize
184KB

Download