emotet | ed22dd68fd9923411084acc6dc9a2db1673a2aab14842a78329b4f5bb8453215

Analysis

max time kernel
136s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2023 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

emotet.dll
Size

684KB
MD5

4024dad64d53d7f43fd00cdbc8d9519a
SHA1

7d5cd9062bb3c170efb190b673a77c33ed719ea6
SHA256

ed22dd68fd9923411084acc6dc9a2db1673a2aab14842a78329b4f5bb8453215
SHA512

e9dacb9570a25f53fcb6fca9fc87d1015e099e3ab434d11f1ddce6cc09a48ef70a5bfccd92aaf89ec7846dc92e61113dd6d6f30b39ffb85475149a7a58155b51
SSDEEP

6144:F/aZgRXcZdinj5y1baFLk5Dw2jb7t3mJXzQ/aCIXilmj2cO8h35jnL/nvYwFaRVb:BamncoLAbcdSxmSc/Jf/ngwFGMD0sg

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

51.75.33.122:443

186.250.48.5:80

168.119.39.118:443

207.148.81.119:8080

194.9.172.107:8080

139.196.72.155:8080

78.47.204.80:443

159.69.237.188:443

45.71.195.104:8080

54.37.106.167:8080

185.168.130.138:443

37.44.244.177:8080

185.184.25.78:8080

185.148.168.15:8080

128.199.192.135:8080

37.59.209.141:8080

103.41.204.169:8080

185.148.168.220:8080

103.42.58.120:7080

78.46.73.125:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4808 regsvr32.exe
4808 regsvr32.exe

pid	process
4808	regsvr32.exe
4808	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 792 wrote to memory of 4808	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 4808	792	regsvr32.exe	regsvr32.exe
PID 792 wrote to memory of 4808	792	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-133-0x0000000002A70000-0x0000000002A97000-memory.dmp

Filesize
156KB

Download