emotet | 89ca6ca49e2f3f0ca9d43e10a59c608d7d4f8fdc117792846dd52b0b327b3212

Analysis

max time kernel
151s
max time network
164s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e50dbd417d9aa062dd14899b795a6dfe73fc9507318d15cb7db2d875e7b3b26.dll
Size

537.5MB
MD5

bee87d5e4e5455cb83a5429d65501003
SHA1

6e0359a8961f9e5e2d83cb50fc88e8c48d7dfffa
SHA256

3e50dbd417d9aa062dd14899b795a6dfe73fc9507318d15cb7db2d875e7b3b26
SHA512

55f3ed30b82d33a9617eaf2807f475a9a5818d1bf3df2365ff4aaedd66d6687466d87811f034b93c7a72e30a4c4303f42a24e060f15810f57a842b3dc2f690b9
SSDEEP

12288:chQZR06Fy1F5YqSDZ9ma2aCStos1F3uD2Hescq2mc:jT08y1F5YqSDZ9ma21Str3cTX

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1704 regsvr32.exe
1928 regsvr32.exe
1928 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1704 regsvr32.exe

pid	process
1704	regsvr32.exe
1928	regsvr32.exe
1928	regsvr32.exe

pid	process
1704	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1704 wrote to memory of 1928	1704	regsvr32.exe	regsvr32.exe
PID 1704 wrote to memory of 1928	1704	regsvr32.exe	regsvr32.exe
PID 1704 wrote to memory of 1928	1704	regsvr32.exe	regsvr32.exe
PID 1704 wrote to memory of 1928	1704	regsvr32.exe	regsvr32.exe
PID 1704 wrote to memory of 1928	1704	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3e50dbd417d9aa062dd14899b795a6dfe73fc9507318d15cb7db2d875e7b3b26.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QxeiZJii\ATdgzxf.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x0000000000300000-0x000000000032C000-memory.dmp

Filesize
176KB

Download
memory/1704-57-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download