Overview

overview

10

Static

static

1

sYYdOjoeG.dll

windows10-1703-x64

10

Resubmissions

18-07-2023 12:55

230718-p5wt4abb6s 10

10-07-2023 02:41

230710-c6x3bsge38 10

24-04-2023 23:28

230424-3geskafc29 10

Analysis

  • max time kernel
    111s
  • max time network
    116s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24-04-2023 23:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sYYdOjoeG.dll

  • Size

    650KB

  • MD5

    bb1372e462191a8c955906a152c59e89

  • SHA1

    32f18efd55f4b5df9c969c3870d07f816ad48430

  • SHA256

    34ba8d9a2fc9779c2261e2c93856d5b24aa6c46048b3520bea0595258f0b9f7a

  • SHA512

    e15f8b1c50956cb64dc6d021e7f609052e8986ecc366e6428ff7f9099acd3232524a7ed0ca6ff1361af763e720d92824d83475a944bd332625b26bf539ef1c88

  • SSDEEP

    12288:VMeQsno2LR+eTz4kMJFGH6C7Fj73Whmrkj5S3u49aP:VDftXegvN7WhmIj5Ouu

Score
10/10
emotetepoch5bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

85.214.93.93:8080

178.62.112.199:8080

68.183.91.111:8080

164.52.194.45:8080

202.29.239.162:443

195.77.239.39:8080

139.196.72.155:8080

54.38.242.185:443

195.154.146.35:443

190.90.233.66:443

87.106.97.83:7080

36.67.23.59:443

59.148.253.194:443

88.217.172.165:8080

103.42.58.120:7080

37.44.244.177:8080

175.126.176.79:8080

203.153.216.46:443

110.235.83.107:7080

45.71.195.104:8080
eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sYYdOjoeG.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2264-121-0x0000000180000000-0x000000018002D000-memory.dmp
    Filesize

    180KB

    Download
  • memory/2264-127-0x0000000180000000-0x000000018002D000-memory.dmp
    Filesize

    180KB

    Download