emotet | 0d89e04481015980b7b995e1abe11996bf7581bd77e38c6c62ec1de32b290dd3

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-03-2023 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VNl72xeYJnnQ183R.dll
Size

547.9MB
MD5

f8c68ffd87972e10d1f3cece3af3036b
SHA1

0bc013c70647ff68861ede6162441e15e6d525a0
SHA256

71635301df9bc1501e4bcfc7929edd9d080eafa6317b5383bf4c50d5fbd6dddd
SHA512

8fe9eb4e5dab003cf7bdc1196a7a3f31f03da5232c40a79526ad7c5e5fa669202e532f15e9a640d06b5dc11095ee29747c4f989b0f0b894c114f2cdbfc614c65
SSDEEP

12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1560 regsvr32.exe
1196 regsvr32.exe
1196 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1560 regsvr32.exe

pid	process
1560	regsvr32.exe
1196	regsvr32.exe
1196	regsvr32.exe

pid	process
1560	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1560 wrote to memory of 1196	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1196	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1196	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1196	1560	regsvr32.exe	regsvr32.exe
PID 1560 wrote to memory of 1196	1560	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VNl72xeYJnnQ183R.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TDKvJCweXgJIHe\MHWeTgXLb.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-54-0x0000000000450000-0x00000000004AA000-memory.dmp

Filesize
360KB

Download
memory/1560-58-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download