emotet | 7fd0dcc951ae2f3b1aa5101cb9e9893a6a75a1321913c2f26824bdbf74e91842

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-01-2023 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pA6TQmVDWARnnU.dll
Size

516KB
MD5

581789105c601d314a2852405a0706a8
SHA1

5404fce9acc305d82fac52cff7ef7d486170dafb
SHA256

7fd0dcc951ae2f3b1aa5101cb9e9893a6a75a1321913c2f26824bdbf74e91842
SHA512

1d270c1b5fde4668f65180a5d013e8a0cd2f7b3924329d1233964e722bf8d8d92420df71fba56adf8b4e296d7fe6b910cc79308ec17687bfb5ada481e1c533c9
SSDEEP

6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEX/n:mW1e9PeexPBjvKSpuvYI+TLgs1dcEX/

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1584 regsvr32.exe
1124 regsvr32.exe
1124 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1584 regsvr32.exe

pid	process
1584	regsvr32.exe
1124	regsvr32.exe
1124	regsvr32.exe

pid	process
1584	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1584 wrote to memory of 1124	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1124	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1124	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1124	1584	regsvr32.exe	regsvr32.exe
PID 1584 wrote to memory of 1124	1584	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\pA6TQmVDWARnnU.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YRxlQKUqvxjAaf\elWbhvP.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-58-0x0000000000000000-mapping.dmp

Download
memory/1584-54-0x000007FEFBDD1000-0x000007FEFBDD3000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download