emotet | 5fa2a02a60dbe35ac130e64590440830d236d9ae17e8ede23523d9ecc8083d1e

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fa2a02a60dbe35ac130e64590440830d236d9ae17e8ede23523d9ecc8083d1e.dll
Size

516KB
MD5

eb88b852fd02ed1ad14131fb363019b3
SHA1

8213645201fca47684c39084a0d7208607ba6843
SHA256

5fa2a02a60dbe35ac130e64590440830d236d9ae17e8ede23523d9ecc8083d1e
SHA512

09eb1110410ef78c412750396b47af7a4d437d28cce0191353a922a4fb8092a7613b274c7846180bdc87e6e6df58286a0fdcf58e721b2bf8896a8177f89db264
SSDEEP

6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXtn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXt

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2964 regsvr32.exe
2764 regsvr32.exe
2764 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2964 regsvr32.exe

pid	process
2964	regsvr32.exe
2764	regsvr32.exe
2764	regsvr32.exe

pid	process
2964	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2964 wrote to memory of 2764	2964	regsvr32.exe	regsvr32.exe
PID 2964 wrote to memory of 2764	2964	regsvr32.exe	regsvr32.exe
PID 2964 wrote to memory of 2764	2964	regsvr32.exe	regsvr32.exe
PID 2964 wrote to memory of 2764	2964	regsvr32.exe	regsvr32.exe
PID 2964 wrote to memory of 2764	2964	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fa2a02a60dbe35ac130e64590440830d236d9ae17e8ede23523d9ecc8083d1e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XfSAQDdq\cgdaBwvPD.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-8-0x000007FEFA380000-0x000007FEFA409000-memory.dmp

Filesize
548KB

Download
memory/2764-11-0x000007FEFA380000-0x000007FEFA409000-memory.dmp

Filesize
548KB

Download
memory/2764-13-0x000007FEFA380000-0x000007FEFA409000-memory.dmp

Filesize
548KB

Download
memory/2964-1-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download
memory/2964-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2964-7-0x000007FEFA380000-0x000007FEFA409000-memory.dmp

Filesize
548KB

Download