emotet | 420f4d1d22c84c9c318d304c9d23a4cfc50194b171d12aa139547a138e84071d

Analysis

max time kernel
151s
max time network
164s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZTt71JOZkARnhsX0wNYTrNWUu.dll
Size

535.9MB
MD5

1e9268ef46de69a2323becab20ca7c8e
SHA1

5a3a781127ab745a321ef8b8caaffa7f96a2c323
SHA256

fd1fdb7faa22021501f10a006a702efe765840a52d6114a48f46dc66c166da93
SHA512

6d8880f060f20ae0b78f19e99e1bcab6c1fe9546623e0d3e10744b97144e2b202451a5535377cc447d2ceb8fface4652acd14b1b5adef43291933ba779d81d6c
SSDEEP

12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2020 regsvr32.exe
1612 regsvr32.exe
1612 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2020 regsvr32.exe

pid	process
2020	regsvr32.exe
1612	regsvr32.exe
1612	regsvr32.exe

pid	process
2020	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2020 wrote to memory of 1612	2020	regsvr32.exe	regsvr32.exe
PID 2020 wrote to memory of 1612	2020	regsvr32.exe	regsvr32.exe
PID 2020 wrote to memory of 1612	2020	regsvr32.exe	regsvr32.exe
PID 2020 wrote to memory of 1612	2020	regsvr32.exe	regsvr32.exe
PID 2020 wrote to memory of 1612	2020	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ZTt71JOZkARnhsX0wNYTrNWUu.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HQwtUOnTytDdZTMRC\gPOzb.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x0000000001C80000-0x0000000001CDA000-memory.dmp

Filesize
360KB

Download
memory/2020-58-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download