emotet | 5459d12f9d7123e5afd93697454ada870b17147ba83a0ddcfe165ac85d8bbda6

Resubmissions

15-05-2023 11:52

230515-n1r5nsfb67 10

03-04-2023 05:27

230403-f5eq5sch96 10

Analysis

max time kernel
295s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2023 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rad56365.tmp.dll
Size

309KB
MD5

bfc060937dc90b273eccb6825145f298
SHA1

c156c00c7e918f0cb7363614fb1f177c90d8108a
SHA256

2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253
SHA512

cc1fee19314b0a0f9e292fa84f6e98f087033d77db937848dda1da0c88f49997866cba5465df04bf929b810b42fdb81481341064c4565c9b6272fa7f3b473ac5
SSDEEP

6144:cwNQMQTlfdUPABVy559hhR3iP7TfPYbrF1EFVw0todxKROsCt:rNbadDBkZ6rPeEFizdxxsCt

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4896 regsvr32.exe
4896 regsvr32.exe
3864 regsvr32.exe
3864 regsvr32.exe
3864 regsvr32.exe
3864 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

4896 regsvr32.exe

pid	process
4896	regsvr32.exe
4896	regsvr32.exe
3864	regsvr32.exe
3864	regsvr32.exe
3864	regsvr32.exe
3864	regsvr32.exe

pid	process
4896	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4896 wrote to memory of 3864	4896	regsvr32.exe	regsvr32.exe
PID 4896 wrote to memory of 3864	4896	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\rad56365.tmp.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzMQsqD\fmSd.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-133-0x0000000000680000-0x00000000006AD000-memory.dmp

Filesize
180KB

Download
memory/4896-136-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download