emotet | 5849618c3ae104f50c8e0d42452eb81703512c59b0b8aa90a7a04da60a7cf59b

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5849618c3ae104f50c8e0d42452eb81703512c59b0b8aa90a7a04da60a7cf59b.dll
Size

580KB
MD5

33ab9d572ebc7ca2b125845d5aa60c83
SHA1

85698ca3765a06c02507079b2e6893c6abcfb0aa
SHA256

5849618c3ae104f50c8e0d42452eb81703512c59b0b8aa90a7a04da60a7cf59b
SHA512

320843d91c4c164fee983995d78ab235957d4a68f2ece0113b7e4ed3ddcd826b0167f1441214a72ed7f2957dc770bca7e57a6bf45fb42fa9b6c97df73ae53e7e
SSDEEP

12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZN9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2UyyrmN9MoIA3n

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080

146.59.226.45:443

51.91.76.89:8080

209.97.163.214:443

158.69.222.101:443

82.165.152.127:8080

103.70.28.102:8080

72.15.201.15:8080

150.95.66.124:8080

45.176.232.124:443

82.223.21.224:8080

107.170.39.149:8080

160.16.142.56:8080

103.132.242.26:8080

153.126.146.25:7080

213.241.20.155:443

1.234.21.73:7080

197.242.150.244:8080

188.44.20.25:443

196.218.30.83:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid	Process
2292	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid	Process
2292	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 2292 wrote to memory of 2652	2292	regsvr32.exe	30
PID 2292 wrote to memory of 2652	2292	regsvr32.exe	30
PID 2292 wrote to memory of 2652	2292	regsvr32.exe	30
PID 2292 wrote to memory of 2652	2292	regsvr32.exe	30
PID 2292 wrote to memory of 2652	2292	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5849618c3ae104f50c8e0d42452eb81703512c59b0b8aa90a7a04da60a7cf59b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OPkenTsO\npfbr.dll"
  2⤵
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x0000000001DC0000-0x0000000001E6A000-memory.dmp

Filesize
680KB

Download
memory/2292-2-0x0000000001DC0000-0x0000000001E6A000-memory.dmp

Filesize
680KB

Download
memory/2292-10-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download
memory/2292-13-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2292-14-0x0000000001DC0000-0x0000000001E6A000-memory.dmp

Filesize
680KB

Download
memory/2652-15-0x0000000000420000-0x00000000004CA000-memory.dmp

Filesize
680KB

Download
memory/2652-17-0x0000000000420000-0x00000000004CA000-memory.dmp

Filesize
680KB

Download