emotet | f41d795231f1a780fc7bf01d7a2028711ec95447d1a0efb61d697d28505ba417

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19-01-2023 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98dc1f2ff077c403438de7d157199286.dll
Size

297KB
MD5

98dc1f2ff077c403438de7d157199286
SHA1

71d294747eb46cda5984b4db4048fe13faa69070
SHA256

f41d795231f1a780fc7bf01d7a2028711ec95447d1a0efb61d697d28505ba417
SHA512

6953b1c51b55287e7ca0a218a3c1f9387355da2c57b57bb7feaba2de5dbe7ff69bd1a43fd2850cace49400e7376780550510469c96367a06bbdaaef73f8af1f7
SSDEEP

6144:yRjSsk3AzLPQWEgbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWLblv4RqFAKiNL4tm2

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

207.148.81.119:8080

159.69.237.188:443

103.8.26.17:8080

194.9.172.107:8080

188.225.32.231:4143

103.56.149.105:8080

139.196.72.155:8080

190.90.233.66:443

37.59.209.141:8080

217.182.143.207:443

78.46.73.125:443

78.47.204.80:443

116.124.128.206:8080

45.71.195.104:8080

87.106.97.83:7080

178.62.112.199:8080

175.126.176.79:8080

134.122.119.23:8080

51.68.141.164:8080

203.153.216.46:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1124 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1220 regsvr32.exe

pid	process
1124	regsvr32.exe

pid	process
1220	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1220 wrote to memory of 1124	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 1124	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 1124	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 1124	1220	regsvr32.exe	regsvr32.exe
PID 1220 wrote to memory of 1124	1220	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\98dc1f2ff077c403438de7d157199286.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NjZeNmGzjd\IQHSFEJGPgFSMJz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-58-0x0000000000000000-mapping.dmp

Download
memory/1220-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download
memory/1220-55-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download