emotet | 3208b01cc79a48c9ca58b01137a3e8917af141a201a783b79d187eaefb2ba6d5

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3208b01cc79a48c9ca58b01137a3e8917af141a201a783b79d187eaefb2ba6d5_NeikiAnalytics.dll
Size

846KB
MD5

b89a5396ebd03d0442b6faed38042780
SHA1

5860b1d771510757875f50483b70f48c2b3e7849
SHA256

3208b01cc79a48c9ca58b01137a3e8917af141a201a783b79d187eaefb2ba6d5
SHA512

636e4e03cb455a7a5e6d9364d000c60a42ed04905cea3dc6d2777e7e3732252d703ed162fdb47e84ca0a828100f251699ff29b3b44081e2dcda64fee5040d238
SSDEEP

24576:sPMTg9U3G0ISDKvSeqfZaePWAy7hmpE3:BTg9UXRD2SeqfZZilm

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

207.148.81.119:8080

159.69.237.188:443

103.8.26.17:8080

194.9.172.107:8080

188.225.32.231:4143

103.56.149.105:8080

139.196.72.155:8080

190.90.233.66:443

37.59.209.141:8080

217.182.143.207:443

78.46.73.125:443

78.47.204.80:443

116.124.128.206:8080

45.71.195.104:8080

87.106.97.83:7080

178.62.112.199:8080

175.126.176.79:8080

134.122.119.23:8080

51.68.141.164:8080

203.153.216.46:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

2732 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1716 regsvr32.exe

pid	process
2732	regsvr32.exe

pid	process
1716	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1716 wrote to memory of 2732	1716	regsvr32.exe	regsvr32.exe
PID 1716 wrote to memory of 2732	1716	regsvr32.exe	regsvr32.exe
PID 1716 wrote to memory of 2732	1716	regsvr32.exe	regsvr32.exe
PID 1716 wrote to memory of 2732	1716	regsvr32.exe	regsvr32.exe
PID 1716 wrote to memory of 2732	1716	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3208b01cc79a48c9ca58b01137a3e8917af141a201a783b79d187eaefb2ba6d5_NeikiAnalytics.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DHMclODkE\jdJKdyJT.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab50B1.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
memory/1716-0-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/1716-3-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1716-4-0x000007FEF6BD0000-0x000007FEF6CA9000-memory.dmp

Filesize
868KB

Download
memory/2732-5-0x000007FEF6B70000-0x000007FEF6C49000-memory.dmp

Filesize
868KB

Download
memory/2732-10-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2732-11-0x000007FEF6B70000-0x000007FEF6C49000-memory.dmp

Filesize
868KB

Download
memory/2732-13-0x000007FEF6B70000-0x000007FEF6C49000-memory.dmp

Filesize
868KB

Download
memory/2732-30-0x000007FEF6B70000-0x000007FEF6C49000-memory.dmp

Filesize
868KB

Download
memory/2732-36-0x000007FEF6B70000-0x000007FEF6C49000-memory.dmp

Filesize
868KB

Download