emotet | 5b39fe7d8001dbae33f800ff4cdf2a24d23ea446a4b3449027955a7098a48ffa

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

726d1dbabba1babd1fd600ed8b21f8b0_NeikiAnalytics.dll
Size

736KB
MD5

726d1dbabba1babd1fd600ed8b21f8b0
SHA1

762c60509e0473bf621d067fcc5a95edede7827b
SHA256

5b39fe7d8001dbae33f800ff4cdf2a24d23ea446a4b3449027955a7098a48ffa
SHA512

478aec6054d2259b10f270f120d2cfc610b7865b364d25d70ff1bb58fb62f53d4c3cf65989f9465278a82fd30b903f65a4ea8f28b7c4a2ee18f8201e992e48cf
SSDEEP

12288:LJsMwUL89WbZz4di6gy1X+9cxhSntqYuXKw29lTxbkTi+kK:LJsMwULdN8d3gy1X+8hIuXKwIlqTtkK

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.254.140.238:7080

103.70.28.102:8080

5.9.116.246:8080

1.234.2.232:8080

209.250.246.206:443

58.227.42.236:80

72.15.201.15:8080

159.65.88.10:8080

189.126.111.200:7080

173.212.193.249:8080

188.44.20.25:443

134.122.66.193:8080

172.104.251.154:8080

103.75.201.2:443

150.95.66.124:8080

153.126.146.25:7080

103.43.75.120:443

203.114.109.124:443

27.54.89.58:8080

1.234.21.73:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

2628 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2860 regsvr32.exe

pid	process
2628	regsvr32.exe

pid	process
2860	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2860 wrote to memory of 2628	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2628	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2628	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2628	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2628	2860	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\726d1dbabba1babd1fd600ed8b21f8b0_NeikiAnalytics.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NBixr\fYbgBZUeQxrFEfO.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-8-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/2628-9-0x0000000010000000-0x00000000100C2000-memory.dmp

Filesize
776KB

Download
memory/2628-11-0x0000000010000000-0x00000000100C2000-memory.dmp

Filesize
776KB

Download
memory/2628-12-0x0000000010000000-0x00000000100C2000-memory.dmp

Filesize
776KB

Download
memory/2628-18-0x0000000010000000-0x00000000100C2000-memory.dmp

Filesize
776KB

Download
memory/2860-0-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/2860-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2860-4-0x0000000010000000-0x00000000100C2000-memory.dmp

Filesize
776KB

Download