emotet | 1b471f783e22bfccd9c40250b481b1225a8cdc638d064e247fdbf747339ff58a

Analysis

max time kernel
131s
max time network
145s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
01-07-2023 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vNzTtU62Z27MnThRPt8Zu8dAn.dll
Size

356KB
MD5

e07d59152703de6dc88ad30c6557512b
SHA1

d5eb69d2155382d4bd8e3055670c6553919f1fe4
SHA256

1b471f783e22bfccd9c40250b481b1225a8cdc638d064e247fdbf747339ff58a
SHA512

413bc240b3e90409c7664adefc718469b2f22949fb2d597987b1f2592505f1bd63b7d3f0a0774b37ff2c00620794a037a2a95357e0442671bcf79cac357fbbaa
SSDEEP

3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTV0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T0RIvgMSS3AyUrhYu3j

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

212.24.98.99:8080

51.91.76.89:8080

94.23.45.86:4143

101.50.0.91:8080

103.43.75.120:443

212.237.17.99:8080

158.69.222.101:443

51.254.140.238:7080

1.234.2.232:8080

91.207.28.33:8080

167.172.253.162:8080

45.235.8.30:8080

115.68.227.76:8080

134.122.66.193:8080

89.29.244.7:443

197.242.150.244:8080

164.68.99.3:8080

5.9.116.246:8080

1.234.21.73:7080

131.100.24.231:80

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

568 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1272 regsvr32.exe

pid	process
568	regsvr32.exe

pid	process
1272	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1272 wrote to memory of 568	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 568	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 568	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 568	1272	regsvr32.exe	regsvr32.exe
PID 1272 wrote to memory of 568	1272	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\vNzTtU62Z27MnThRPt8Zu8dAn.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DhWwv\rQEojD.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab40AB.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
memory/568-60-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/568-61-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1272-54-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download