emotet | 8e6a162f58de7ba5ced98ad89eb02c5f29349010c80ff8fb249f7be3dc41a702

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e6a162f58de7ba5ced98ad89eb02c5f29349010c80ff8fb249f7be3dc41a702.dll
Size

740KB
MD5

823468bb2a2a183222e308b25b7f8953
SHA1

29539bb8aea02a0d73d7b44192df8751254c9cfb
SHA256

8e6a162f58de7ba5ced98ad89eb02c5f29349010c80ff8fb249f7be3dc41a702
SHA512

51164d7a8efcf267ee2be9bef11fd32bb5454a768f8f58a316e95e333f8107922b09335be101d745fbb60d08f6745d33d36fdd0eb5352f5e106218d566d980f6
SSDEEP

12288:e+GedJbn7eOaMrvbn1ndVFM9r4GVqvHMN7prpH3VTTQLpLcXJuJvrMS40aRCxgeV:e+GedJveOaMrvr1nnUN7dpH3VgN4XJ4t

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.254.140.238:7080

103.70.28.102:8080

5.9.116.246:8080

1.234.2.232:8080

209.250.246.206:443

58.227.42.236:80

72.15.201.15:8080

159.65.88.10:8080

189.126.111.200:7080

173.212.193.249:8080

188.44.20.25:443

134.122.66.193:8080

172.104.251.154:8080

103.75.201.2:443

150.95.66.124:8080

153.126.146.25:7080

103.43.75.120:443

203.114.109.124:443

27.54.89.58:8080

1.234.21.73:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3024	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2792	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 3024	2792	regsvr32.exe	29
PID 2792 wrote to memory of 3024	2792	regsvr32.exe	29
PID 2792 wrote to memory of 3024	2792	regsvr32.exe	29
PID 2792 wrote to memory of 3024	2792	regsvr32.exe	29
PID 2792 wrote to memory of 3024	2792	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e6a162f58de7ba5ced98ad89eb02c5f29349010c80ff8fb249f7be3dc41a702.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AMUtYsZH\tBGR.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2792-1-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/2792-4-0x000007FEFB2D0000-0x000007FEFB38F000-memory.dmp

Filesize
764KB

Download
memory/3024-5-0x000007FEFB210000-0x000007FEFB2CF000-memory.dmp

Filesize
764KB

Download
memory/3024-12-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/3024-13-0x000007FEFB210000-0x000007FEFB2CF000-memory.dmp

Filesize
764KB

Download
memory/3024-16-0x000007FEFB210000-0x000007FEFB2CF000-memory.dmp

Filesize
764KB

Download
memory/3024-17-0x000007FEFB210000-0x000007FEFB2CF000-memory.dmp

Filesize
764KB

Download