emotet | 6fc7b4dcd58972a4028f38afe3c782ff35e3a921130a6804df122521db7c22a1

Analysis

max time kernel
130s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 17:52 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fc7b4dcd58972a4028f38afe3c782ff35e3a921130a6804df122521db7c22a1.dll
Size

846KB
MD5

6c08bf4631dffbe49b0d209117073fbf
SHA1

e5aa6dd4ed9d7daba43207cf5bed5dd20bd845f9
SHA256

6fc7b4dcd58972a4028f38afe3c782ff35e3a921130a6804df122521db7c22a1
SHA512

f84556c14b36bf80633cb02c03330a1ceda0616d281ca1976c934e2394a77b6fda1a2028837ef3e831afe8fa8056bb057d2ed91cdd8aafefbf5184e5ed89232a
SSDEEP

24576:sPMTg9U3G0ISDKvSeqfZaePWAy74mpE3:BTg9UXRD2SeqfZZi8m

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

207.148.81.119:8080

159.69.237.188:443

103.8.26.17:8080

194.9.172.107:8080

188.225.32.231:4143

103.56.149.105:8080

139.196.72.155:8080

190.90.233.66:443

37.59.209.141:8080

217.182.143.207:443

78.46.73.125:443

78.47.204.80:443

116.124.128.206:8080

45.71.195.104:8080

87.106.97.83:7080

178.62.112.199:8080

175.126.176.79:8080

134.122.119.23:8080

51.68.141.164:8080

203.153.216.46:443

ecs1.plain

1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9C8agzYaJ1GMJPLKqOyFrlJZUXVI
3
lAZwAnOq6JrEKHtWCQ+8CHuAIXqmKH6WRbnDw1wmdM/YvqKFH36nqC2VNA==
4
-----END PUBLIC KEY-----

eck1.plain

1
-----BEGIN PUBLIC KEY-----
2
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2DWT12OLUMXfzeFp+bE2AJubVDsW
3
NqJdRC6yODDYRzYuuNL0i2rI2Ex6RUQaBvqPOL7a+wCWnIQszh42gCRQlg==
4
-----END PUBLIC KEY-----

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5008	regsvr32.exe
5008	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2360	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 5008	2360	regsvr32.exe	89
PID 2360 wrote to memory of 5008	2360	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6fc7b4dcd58972a4028f38afe3c782ff35e3a921130a6804df122521db7c22a1.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZvrePga\tcEJqNXoZsGkEj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008

Network

DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR

Response
DNS

219.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

219.135.221.88.in-addr.arpa

IN PTR

Response

219.135.221.88.in-addr.arpa

IN PTR

a88-221-135-219deploystaticakamaitechnologiescom
DNS

68.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.32.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

200.163.202.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.163.202.172.in-addr.arpa

IN PTR

Response
DNS

241.42.69.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.42.69.40.in-addr.arpa

IN PTR

Response
DNS

41.110.86.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.110.86.104.in-addr.arpa

IN PTR

Response

41.110.86.104.in-addr.arpa

IN PTR

a104-86-110-41deploystaticakamaitechnologiescom
DNS

68.209.201.84.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.209.201.84.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response

103.8.26.17:8080

regsvr32.exe

260 B
200 B
5
5
134.122.119.23:8080

regsvr32.exe

260 B
160 B
5
4
104.248.225.227:8080

regsvr32.exe

260 B
5
188.225.32.231:4143

regsvr32.exe

260 B
5
195.154.146.35:443

regsvr32.exe

260 B
5
178.62.112.199:8080

regsvr32.exe

260 B
5

8.8.8.8:53

232.168.11.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

232.168.11.51.in-addr.arpa
8.8.8.8:53

219.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

219.135.221.88.in-addr.arpa
8.8.8.8:53

68.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

68.32.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

200.163.202.172.in-addr.arpa

dns

74 B
160 B
1
1

DNS Request

200.163.202.172.in-addr.arpa
8.8.8.8:53

241.42.69.40.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

241.42.69.40.in-addr.arpa
8.8.8.8:53

41.110.86.104.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

41.110.86.104.in-addr.arpa
8.8.8.8:53

68.209.201.84.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

68.209.201.84.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x0000000001600000-0x0000000001601000-memory.dmp

Filesize
4KB

Download
memory/2360-1-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2360-4-0x00007FF9F7D00000-0x00007FF9F7DD9000-memory.dmp

Filesize
868KB

Download
memory/5008-8-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.