emotet | 9b7e1f5a4c6ae4037e7bf0e18c1a699c5662c260e4d89c4db91c316a77c7bff2

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b7e1f5a4c6ae4037e7bf0e18c1a699c5662c260e4d89c4db91c316a77c7bff2.dll
Size

405KB
MD5

95f19d6595806ff6753a29c2f3e31c8f
SHA1

227818331e65362d4e7e506c24286dca4a270fc5
SHA256

9b7e1f5a4c6ae4037e7bf0e18c1a699c5662c260e4d89c4db91c316a77c7bff2
SHA512

31a2403577a797ab2e02d11a5a01ef6cecc3000a1e1dc30c4de1644c7548442dca897145c303edd06848bbe482b5351a8b672cdce74546316afc5b1fe4ad1439
SSDEEP

6144:GgIYnzcJxDpmJIyeV2vR3JDEohHEuRfoP1SKL0w+d7sWOQSH0E9cWdb3BHq:yKz+1pcIuvR3lEoFEu+9T0Rd4Hr9H3

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.254.140.238:7080

103.70.28.102:8080

5.9.116.246:8080

1.234.2.232:8080

209.250.246.206:443

58.227.42.236:80

72.15.201.15:8080

159.65.88.10:8080

189.126.111.200:7080

173.212.193.249:8080

188.44.20.25:443

134.122.66.193:8080

172.104.251.154:8080

103.75.201.2:443

150.95.66.124:8080

153.126.146.25:7080

103.43.75.120:443

203.114.109.124:443

27.54.89.58:8080

1.234.21.73:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2096	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2568	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2096	2568	regsvr32.exe	31
PID 2568 wrote to memory of 2096	2568	regsvr32.exe	31
PID 2568 wrote to memory of 2096	2568	regsvr32.exe	31
PID 2568 wrote to memory of 2096	2568	regsvr32.exe	31
PID 2568 wrote to memory of 2096	2568	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9b7e1f5a4c6ae4037e7bf0e18c1a699c5662c260e4d89c4db91c316a77c7bff2.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVRwJPRYpEccVsYd\hhiYTaZ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-8-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/2096-9-0x000007FEF72A0000-0x000007FEF730C000-memory.dmp

Filesize
432KB

Download
memory/2096-12-0x000007FEF72A0000-0x000007FEF730C000-memory.dmp

Filesize
432KB

Download
memory/2096-14-0x000007FEF72A0000-0x000007FEF730C000-memory.dmp

Filesize
432KB

Download
memory/2096-19-0x000007FEF72A0000-0x000007FEF730C000-memory.dmp

Filesize
432KB

Download
memory/2096-21-0x000007FEF72A0000-0x000007FEF730C000-memory.dmp

Filesize
432KB

Download
memory/2096-22-0x000007FEF72A0000-0x000007FEF730C000-memory.dmp

Filesize
432KB

Download
memory/2568-0-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/2568-4-0x000007FEF7300000-0x000007FEF736C000-memory.dmp

Filesize
432KB

Download