emotet | 0129237e06909bebd0c0a128a8201b3f73278e2623af46305d67e7b4d848a7e3

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0129237e06909bebd0c0a128a8201b3f73278e2623af46305d67e7b4d848a7e3.dll
Size

180KB
MD5

9a0f5b745b67c77f3bee6fba383b9d6f
SHA1

b694b55b78017e473f298cb5bedc7ab8489c7aad
SHA256

0129237e06909bebd0c0a128a8201b3f73278e2623af46305d67e7b4d848a7e3
SHA512

d39d6fc6dc14cab0ab5f218cfb4dbd6a45f42287dd5a4975bdfde00bf46bef8989c7d87a7feee4deb5cdde71f1a05663c7d7bcc0009ddc4cd88c7f9dcdb904e9
SSDEEP

3072:rpjfBFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRpWW6u8QKkXzN/09gjV/eey5/NsAziz

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

78.47.204.80:443

212.83.184.188:8080

36.67.23.59:443

128.199.217.206:443

103.56.149.105:8080

202.29.239.162:443

68.183.91.111:8080

104.244.79.94:443

64.227.55.231:8080

157.230.99.206:8080

165.232.185.110:8080

103.71.99.57:8080

103.126.216.86:443

88.217.172.165:8080

103.41.204.169:8080

87.106.97.83:7080

85.25.120.45:8080

188.225.32.231:4143

118.98.72.86:443

178.62.112.199:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2088	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2088	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2744	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2744	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2744	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2744	2088	regsvr32.exe	30
PID 2088 wrote to memory of 2744	2088	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0129237e06909bebd0c0a128a8201b3f73278e2623af46305d67e7b4d848a7e3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FUInsoNBJEVkQ\BFOHnLHNmjJ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-3-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2088-0-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download
memory/2088-4-0x0000000065280000-0x00000000652B6000-memory.dmp

Filesize
216KB

Download
memory/2744-8-0x0000000065280000-0x00000000652B6000-memory.dmp

Filesize
216KB

Download