emotet | a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd.dll
Size

418KB
MD5

5375ff373df38f4dde8f1b1dbcb3b31b
SHA1

8ce588d597c71834e5c7dc15ab1edfeca579e4ea
SHA256

a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd
SHA512

886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51
SSDEEP

12288:0/aTeMFXEH/MPkEzOT8o4hO/LYxwe0Qp8M2:0/aTeMWTVT8w1QpJ

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

138.197.147.101:443

134.195.212.50:7080

104.168.154.79:8080

149.56.131.28:8080

187.84.80.182:443

158.69.222.101:443

91.207.28.33:8080

5.9.116.246:8080

103.70.28.102:8080

153.126.146.25:7080

189.126.111.200:7080

110.232.117.186:8080

167.99.115.35:8080

146.59.226.45:443

201.94.166.162:443

103.43.46.182:443

103.132.242.26:8080

185.4.135.165:8080

159.65.88.10:8080

1.234.21.73:7080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3940 regsvr32.exe
Drops file in System32 directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\system32\Vgkpctrhghtnvu\hpxecqepzl.xhc regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3940 regsvr32.exe
3940 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1548 regsvr32.exe

pid	process
3940	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\system32\Vgkpctrhghtnvu\hpxecqepzl.xhc	regsvr32.exe

pid	process
3940	regsvr32.exe
3940	regsvr32.exe

pid	process
1548	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1548 wrote to memory of 3940	1548	regsvr32.exe	regsvr32.exe
PID 1548 wrote to memory of 3940	1548	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd.dll
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Vgkpctrhghtnvu\hpxecqepzl.xhc"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Vgkpctrhghtnvu\hpxecqepzl.xhc
Filesize
418KB

MD5
5375ff373df38f4dde8f1b1dbcb3b31b

SHA1
8ce588d597c71834e5c7dc15ab1edfeca579e4ea

SHA256
a7382facbd03fb12d421629ce240b1e119f7ee6dfbdd16a96a9f86d3fce906cd

SHA512
886092d33dec60ce51a6139abd6a8e6eba01b43715c64b50788e936e1e58a9adf7eeaf4a71aaf3e176ca0a4797ba26b6fd9f55af7c4d4a94da1a82fb6e885f51

Download Submit
memory/1548-0-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download
memory/1548-1-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/3940-10-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download