emotet | f6ff2605da1d680e1cffe2cdfcf12ebde0a47d82fb9c089c8afc8419a08d968b

Analysis

max time kernel
147s
max time network
181s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
10-11-2023 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.e1178fb0fc1093017b2cc7b7c8a95680.dll
Size

462KB
MD5

e1178fb0fc1093017b2cc7b7c8a95680
SHA1

57253c1bcd80be71a62ac5f4cca8495191c533f8
SHA256

f6ff2605da1d680e1cffe2cdfcf12ebde0a47d82fb9c089c8afc8419a08d968b
SHA512

54205f3bd93f5683038c2254541c4561cf81c9bc1b23990d2dc4dcf21bf93549a9e41f6c95e387a7947808364d120c12da3f81173cba4016e0b6b70ce1d46fc9
SSDEEP

12288:JsyuV3YB8c3Ok0d9ubQKyJ34a5ohe4tqUsa:JsyuV1uOybSVh5oAhja

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1748 regsvr32.exe
2752 regsvr32.exe
2752 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1748 regsvr32.exe

pid	process
1748	regsvr32.exe
2752	regsvr32.exe
2752	regsvr32.exe

pid	process
1748	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1748 wrote to memory of 2752	1748	regsvr32.exe	regsvr32.exe
PID 1748 wrote to memory of 2752	1748	regsvr32.exe	regsvr32.exe
PID 1748 wrote to memory of 2752	1748	regsvr32.exe	regsvr32.exe
PID 1748 wrote to memory of 2752	1748	regsvr32.exe	regsvr32.exe
PID 1748 wrote to memory of 2752	1748	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.e1178fb0fc1093017b2cc7b7c8a95680.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IRUKCrzkg\NqaAhOEqylnxW.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-0-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/1748-2-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download