emotet | c9fa5ff5c96152add509bbc32a117d6135273a2cb607ba5877b62133591285aa

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9fa5ff5c96152add509bbc32a117d6135273a2cb607ba5877b62133591285aa.dll
Size

608KB
MD5

53735aa47a2c5388f24f1cdc6dae7ec8
SHA1

d763d8a787264200dedef07e79add54d5d42f8f4
SHA256

c9fa5ff5c96152add509bbc32a117d6135273a2cb607ba5877b62133591285aa
SHA512

885f0c04f5f0b69409ffad1eedacf240cdd70ebd83c890b96bd5aa7e3e40c78c4bf463e7302308d36a1882df9392fd4b0893dcb760e3a8650bc251fa8719443a
SSDEEP

6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADhcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3/3fVbeFTi40

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

8.9.11.48:443

144.76.186.55:7080

45.118.115.99:8080

51.254.140.238:7080

162.214.50.39:7080

119.235.255.201:8080

103.75.201.4:443

164.68.99.3:8080

178.79.147.66:8080

192.95.56.148:8080

81.0.236.90:443

45.118.135.203:7080

131.100.24.231:80

41.76.108.46:8080

45.142.114.231:8080

82.165.152.127:8080

45.176.232.124:443

50.116.54.215:443

162.243.175.63:443

216.158.226.206:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 2800 wrote to memory of 1744	2800	regsvr32.exe	regsvr32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe
PID 1744 wrote to memory of 2292	1744	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c9fa5ff5c96152add509bbc32a117d6135273a2cb607ba5877b62133591285aa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\c9fa5ff5c96152add509bbc32a117d6135273a2cb607ba5877b62133591285aa.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c9fa5ff5c96152add509bbc32a117d6135273a2cb607ba5877b62133591285aa.dll",DllRegisterServer
3⤵
PID:2292

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-0-0x00000000001F0000-0x0000000000218000-memory.dmp

Filesize
160KB

Download