emotet | 67ad2b931dc7b6f5f5deeec12939f59ec507f1d201007612037517514818d7bb

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67ad2b931dc7b6f5f5deeec12939f59ec507f1d201007612037517514818d7bb.dll
Size

727KB
MD5

e1e7beb41bcad29dd253f69e7d572d3c
SHA1

044677a53c3aaad12dd487c6511e98af57f3f8fd
SHA256

67ad2b931dc7b6f5f5deeec12939f59ec507f1d201007612037517514818d7bb
SHA512

2fc692c4c9b6df57693b92c6b470fce627827859644c8262f9b3c6663c4e4f567a0c2c7cf183db5e11b12de4edcc3c942240b3d663b7e8b60c715fc0ab92ff3b
SSDEEP

12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+aSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6jjtJqzf

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1276	regsvr32.exe
2144	regsvr32.exe
2144	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1276	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2144	1276	regsvr32.exe	29
PID 1276 wrote to memory of 2144	1276	regsvr32.exe	29
PID 1276 wrote to memory of 2144	1276	regsvr32.exe	29
PID 1276 wrote to memory of 2144	1276	regsvr32.exe	29
PID 1276 wrote to memory of 2144	1276	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67ad2b931dc7b6f5f5deeec12939f59ec507f1d201007612037517514818d7bb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UAFvPQawu\YAZPzGSTMEEplp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1276-3-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1276-7-0x000007FEFB930000-0x000007FEFB9F0000-memory.dmp

Filesize
768KB

Download
memory/2144-8-0x000007FEFB930000-0x000007FEFB9F0000-memory.dmp

Filesize
768KB

Download
memory/2144-11-0x000007FEFB930000-0x000007FEFB9F0000-memory.dmp

Filesize
768KB

Download