emotet | 30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8.dll
Size

652KB
MD5

6533cbce314b3b88abcb1686b7d26a91
SHA1

9df9a40839182f8b52ba53d3834f4ab13e7d450b
SHA256

30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8
SHA512

1d821140d4337270eb1769bb3a28bf415f0fe7855f538ea11ccec3ff3b1275804cc15047dceb609ffd2b410dd24f564c641237af1ccfb122de654f9c8a780b8c
SSDEEP

12288:y6f5tUaLG1iZuyzbVysg1wuKWKDYjX3rUXY:ygHpbVy9750YjX3N

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

135.148.121.246:8080

213.190.4.223:7080

175.107.196.192:80

46.55.222.11:443

153.126.203.229:8080

138.185.72.26:8080

45.118.135.203:7080

107.182.225.142:8080

195.154.133.20:443

79.172.212.216:8080

129.232.188.93:443

50.30.40.196:8080

131.100.24.231:80

58.227.42.236:80

216.158.226.206:443

45.118.115.99:8080

51.254.140.238:7080

173.212.193.249:8080

110.232.117.186:8080

81.0.236.90:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1520 regsvr32.exe
1520 regsvr32.exe

pid	process
1520	regsvr32.exe
1520	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2564 wrote to memory of 1520	2564	regsvr32.exe	regsvr32.exe
PID 2564 wrote to memory of 1520	2564	regsvr32.exe	regsvr32.exe
PID 2564 wrote to memory of 1520	2564	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download