emotet | 5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975

General

Target

I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll
Size

518.9MB
MD5

8d4ae113a4228abb787118fa7f080f07
SHA1

06484d09a45370765db7eec6a2998551215806f2
SHA256

5418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975
SHA512

0944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116
SSDEEP

12288:6iWi2RszBxSICcO5w6SudYEW/N4HTJ4NYu3cX:4inOcO5wJVETHTJwYusX

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

regsvr32.exeregsvr32.exechrome.exe

pid process

816 regsvr32.exe
1984 regsvr32.exe
1984 regsvr32.exe
1872 chrome.exe
1872 chrome.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

816 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

chrome.exe

description pid process

Token: SeShutdownPrivilege 1872 chrome.exe
Token: SeShutdownPrivilege 1872 chrome.exe

pid	process
816	regsvr32.exe
1984	regsvr32.exe
1984	regsvr32.exe
1872	chrome.exe
1872	chrome.exe

pid	process
816	regsvr32.exe

description	pid	process
Token: SeShutdownPrivilege	1872	chrome.exe
Token: SeShutdownPrivilege	1872	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exechrome.exe

description	pid	process	target process
PID 816 wrote to memory of 1984	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 1984	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 1984	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 1984	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 1984	816	regsvr32.exe	regsvr32.exe
PID 1872 wrote to memory of 520	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 520	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 520	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 920	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1764	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1764	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1764	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe
PID 1872 wrote to memory of 1544	1872	chrome.exe	chrome.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FADUrErGZhW\xVYXcisiL.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6cb9758,0x7fef6cb9768,0x7fef6cb9778
2⤵
PID:520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1220 --field-trial-handle=1276,i,17374146542706812378,7440616057119559232,131072 /prefetch:2
2⤵
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1276,i,17374146542706812378,7440616057119559232,131072 /prefetch:8
2⤵
PID:1764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1276,i,17374146542706812378,7440616057119559232,131072 /prefetch:8
2⤵
PID:1544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1276,i,17374146542706812378,7440616057119559232,131072 /prefetch:1
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1276,i,17374146542706812378,7440616057119559232,131072 /prefetch:1
2⤵
PID:1712

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\crashpad_1872_NTOJFKNANQJTUECS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/816-54-0x0000000001E20000-0x0000000001E7A000-memory.dmp

Filesize
360KB

Download
memory/816-58-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads