emotet | b27af903c4610a7bf8ef2dc2d5956da79487ffb574534ce7340579a2ba2035f5

Analysis

max time kernel
146s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b27af903c4610a7bf8ef2dc2d5956da79487ffb574534ce7340579a2ba2035f5.dll
Size

742KB
MD5

708704bb4c7ba1a8e6d65a8ead48e6ff
SHA1

1259b0bf90521b1dd2636976d85fc212a2f63f20
SHA256

b27af903c4610a7bf8ef2dc2d5956da79487ffb574534ce7340579a2ba2035f5
SHA512

8d7324d48becf52ba29096bc7cfa5ec013da5ee32929f07f8df11bc69bc0bb9105e87981f5af1a802b2d8d75d7dda66721cd5aaa3b010abf76128b9f1e980ee8
SSDEEP

12288:ckd4N2A+TyrjNDCaVN+kC1FXWWf3HlTT1LwmBvb:ckdxT2rZDCaVN+LXWW3HBemBj

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

207.148.81.119:8080

159.69.237.188:443

103.8.26.17:8080

194.9.172.107:8080

188.225.32.231:4143

103.56.149.105:8080

139.196.72.155:8080

190.90.233.66:443

37.59.209.141:8080

217.182.143.207:443

78.46.73.125:443

78.47.204.80:443

116.124.128.206:8080

45.71.195.104:8080

87.106.97.83:7080

178.62.112.199:8080

175.126.176.79:8080

134.122.119.23:8080

51.68.141.164:8080

203.153.216.46:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2972	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2688	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2972	2688	regsvr32.exe	31
PID 2688 wrote to memory of 2972	2688	regsvr32.exe	31
PID 2688 wrote to memory of 2972	2688	regsvr32.exe	31
PID 2688 wrote to memory of 2972	2688	regsvr32.exe	31
PID 2688 wrote to memory of 2972	2688	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b27af903c4610a7bf8ef2dc2d5956da79487ffb574534ce7340579a2ba2035f5.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ShChjYMvUWitUzMu\xpxOrV.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-0-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2688-1-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2688-4-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2972-8-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2972-9-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2972-12-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2972-13-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download
memory/2972-18-0x0000000010000000-0x00000000100C4000-memory.dmp

Filesize
784KB

Download