emotet | 20d9a37b9529ba04d1c4a87d48c1111490deb900c3c1f6dfaacdb7f7c5483948

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2023 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jwnfVwi3Fi0fBoNY.dll
Size

528.5MB
MD5

52fca906ec2ceaf52d16a795cbe70c03
SHA1

973b24f31999a6a6a8a94a698f656d662c612f7b
SHA256

ecc7a177e61204ae5ae37b1eb38b1b0ae59559712094b8627a8750f4cf695586
SHA512

d0a793db73b552e958cd6a5801157f95691d9ce05ef3a6daaa1b6c1d57ea134c925284ca21865046516ee8b187455c5da233313854189d69ae50b61971fd3df7
SSDEEP

6144:ZS+strpYZOLnN6zBiWmLcipbxTV5bEgWrhTmi3ve2vof2PPMIf39yeuLcLwdi:ZbapYTiDcidxTJUdpe2vofQMIfUb

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4404	regsvr32.exe
4404	regsvr32.exe
4392	regsvr32.exe
4392	regsvr32.exe
4392	regsvr32.exe
4392	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4404	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4392	4404	regsvr32.exe	85
PID 4404 wrote to memory of 4392	4404	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jwnfVwi3Fi0fBoNY.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NeiDc\NgsGSwCHRGxkrvY.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4404-133-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download
memory/4404-136-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download