emotet | a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0.dll
Size

736KB
MD5

8de6f0db50a0731d34a8943dd739e0dc
SHA1

ceae5dc08531548f74fa3a46b9a66a4ddb3422bd
SHA256

a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0
SHA512

0b9cb8c5579e3d0e0ba2a804fda952308e23623ee5c04eee78e2a5790d4c4b213c0020df1bb9ae1f846b39b159026193d336ad4707ff5b4c44c7b8f2e4ebcafc
SSDEEP

12288:WZjb8BOPxue5dKV9M/98f0koP5XvkgKtuBdfMAofD:WCBAdKV9Xf0kK3KMBdkAofD

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

45.76.1.145:443

217.182.25.250:8080

119.193.124.41:7080

192.99.251.50:443

146.59.226.45:443

173.212.193.249:8080

207.38.84.195:8080

45.118.135.203:7080

31.24.158.56:8080

209.126.98.206:8080

212.237.17.99:8080

216.158.226.206:443

50.30.40.196:8080

82.165.152.127:8080

159.8.59.82:8080

107.182.225.142:8080

110.232.117.186:8080

72.15.201.15:8080

5.9.116.246:8080

79.172.212.216:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3176 regsvr32.exe
Drops file in System32 directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Ueohtcp\ledstf.ujh regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3176 regsvr32.exe
3176 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3728 regsvr32.exe

pid	process
3176	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ueohtcp\ledstf.ujh	regsvr32.exe

pid	process
3176	regsvr32.exe
3176	regsvr32.exe

pid	process
3728	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4976 wrote to memory of 3728	4976	regsvr32.exe	regsvr32.exe
PID 4976 wrote to memory of 3728	4976	regsvr32.exe	regsvr32.exe
PID 4976 wrote to memory of 3728	4976	regsvr32.exe	regsvr32.exe
PID 3728 wrote to memory of 3176	3728	regsvr32.exe	regsvr32.exe
PID 3728 wrote to memory of 3176	3728	regsvr32.exe	regsvr32.exe
PID 3728 wrote to memory of 3176	3728	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0.dll
2⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ueohtcp\ledstf.ujh"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ueohtcp\ledstf.ujh
Filesize
736KB

MD5
8de6f0db50a0731d34a8943dd739e0dc

SHA1
ceae5dc08531548f74fa3a46b9a66a4ddb3422bd

SHA256
a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0

SHA512
0b9cb8c5579e3d0e0ba2a804fda952308e23623ee5c04eee78e2a5790d4c4b213c0020df1bb9ae1f846b39b159026193d336ad4707ff5b4c44c7b8f2e4ebcafc

Download Submit
memory/3176-5-0x0000000000A40000-0x0000000000A75000-memory.dmp

Filesize
212KB

Download
memory/3728-0-0x0000000002620000-0x0000000002655000-memory.dmp

Filesize
212KB

Download