emotet | 5c4bd4d36082e4838eeaf282fef9ad95689f8e1944cf2d300ecc2461c6f9c88e

Analysis

max time kernel
152s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1gpj9zFK.dll
Size

543.5MB
MD5

b2cc0f3ae3052df9130e34777e518e91
SHA1

5ff0b9c01d29198fe9eeabc95bff2b4ba8db3c64
SHA256

9d309c150ee4f16dd73f559e0b6427ce5da5c3ce2f27c00232550fa5f72c2370
SHA512

c7e3817bad8195ac2d69b1bdb0ea7da1cb7d09cb2c0ee64c074f37eacd782bbd52b83de1b25eace8460b57a6830cdc2d81102e1e6b977fb31a0e8ef9669e76fe
SSDEEP

6144:fS+sfPZYZOdngAieP+GzBiWmLcipb1v/33R7U2h2ARWvpiOhbeinCSEVLcLwdi:fbUZYFP4iDcidBhVh2ARMiSCSEb

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1216 regsvr32.exe
1028 regsvr32.exe
1028 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1216 regsvr32.exe

pid	process
1216	regsvr32.exe
1028	regsvr32.exe
1028	regsvr32.exe

pid	process
1216	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1216 wrote to memory of 1028	1216	regsvr32.exe	regsvr32.exe
PID 1216 wrote to memory of 1028	1216	regsvr32.exe	regsvr32.exe
PID 1216 wrote to memory of 1028	1216	regsvr32.exe	regsvr32.exe
PID 1216 wrote to memory of 1028	1216	regsvr32.exe	regsvr32.exe
PID 1216 wrote to memory of 1028	1216	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1gpj9zFK.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GKLKhUgnP\vHIapvhtsdirfKS.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x0000000180000000-0x000000018002C000-memory.dmp

Filesize
176KB

Download
memory/1216-57-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download