emotet | cfb75b3fba2d6d1773fe9e22870a2d585864c2055bb5d870c48091272fd32f12

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfb75b3fba2d6d1773fe9e22870a2d585864c2055bb5d870c48091272fd32f12.dll
Size

742KB
MD5

0e44a44f8365e012b6cc2072cf97f498
SHA1

df10a08eee274ca24f916de141453b825b3662a6
SHA256

cfb75b3fba2d6d1773fe9e22870a2d585864c2055bb5d870c48091272fd32f12
SHA512

46a6a91f412ade60cb24cbaef06ca0fa84380fbd97d1a9f31927edaaec080d73332a3c55abf796408a9efd6b62c376d9f6fdcb9251f1068c6d03627d5606e56a
SSDEEP

12288:ckd4N2A+TyrjNDCaVN+dC1FXWWf3HlTT1LwmBvb:ckdxT2rZDCaVN+mXWW3HBemBj

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

207.148.81.119:8080

159.69.237.188:443

103.8.26.17:8080

194.9.172.107:8080

188.225.32.231:4143

103.56.149.105:8080

139.196.72.155:8080

190.90.233.66:443

37.59.209.141:8080

217.182.143.207:443

78.46.73.125:443

78.47.204.80:443

116.124.128.206:8080

45.71.195.104:8080

87.106.97.83:7080

178.62.112.199:8080

175.126.176.79:8080

134.122.119.23:8080

51.68.141.164:8080

203.153.216.46:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

2428 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2580 regsvr32.exe

pid	process
2428	regsvr32.exe

pid	process
2580	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2580 wrote to memory of 2428	2580	regsvr32.exe	regsvr32.exe
PID 2580 wrote to memory of 2428	2580	regsvr32.exe	regsvr32.exe
PID 2580 wrote to memory of 2428	2580	regsvr32.exe	regsvr32.exe
PID 2580 wrote to memory of 2428	2580	regsvr32.exe	regsvr32.exe
PID 2580 wrote to memory of 2428	2580	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cfb75b3fba2d6d1773fe9e22870a2d585864c2055bb5d870c48091272fd32f12.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SRfWNzjxluuTfbt\ZNruO.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-8-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2428-9-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2428-12-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2428-13-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2428-18-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2580-0-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2580-1-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2580-4-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download