emotet | 7c6aa8e47a879d824349bd92e9eb176428858b7699c61ec4b14feabc8acb7458

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c6aa8e47a879d824349bd92e9eb176428858b7699c61ec4b14feabc8acb7458.dll
Size

297KB
MD5

93c1f13ee49501afeb74b9ea2faab10b
SHA1

107157870d1f95fcf119e393e0e72278562279bc
SHA256

7c6aa8e47a879d824349bd92e9eb176428858b7699c61ec4b14feabc8acb7458
SHA512

3e8a958c2d3f7e00a6228d71dacdd7e779701241c000556b89068c8f2e48d4095aa66ec63e04447b279f99a228b1dad302a38ffafed4adebea3f85707d1208d4
SSDEEP

6144:yRjSsk3AzLPQW8gbZJpDphv4MOTRqhTAK3yUil5FCsCfHG72:ojVhTQWTblv4RqFAKiNL4tm2

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

207.148.81.119:8080

159.69.237.188:443

103.8.26.17:8080

194.9.172.107:8080

188.225.32.231:4143

103.56.149.105:8080

139.196.72.155:8080

190.90.233.66:443

37.59.209.141:8080

217.182.143.207:443

78.46.73.125:443

78.47.204.80:443

116.124.128.206:8080

45.71.195.104:8080

87.106.97.83:7080

178.62.112.199:8080

175.126.176.79:8080

134.122.119.23:8080

51.68.141.164:8080

203.153.216.46:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2776	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2424	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2776	2424	regsvr32.exe	30
PID 2424 wrote to memory of 2776	2424	regsvr32.exe	30
PID 2424 wrote to memory of 2776	2424	regsvr32.exe	30
PID 2424 wrote to memory of 2776	2424	regsvr32.exe	30
PID 2424 wrote to memory of 2776	2424	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7c6aa8e47a879d824349bd92e9eb176428858b7699c61ec4b14feabc8acb7458.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\URFBvZzmmwsu\CSIkCizI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-0-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2424-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2424-4-0x000007FEFA4F0000-0x000007FEFA540000-memory.dmp

Filesize
320KB

Download
memory/2776-8-0x0000000180000000-0x0000000180031000-memory.dmp

Filesize
196KB

Download
memory/2776-9-0x000007FEFA960000-0x000007FEFA9B0000-memory.dmp

Filesize
320KB

Download
memory/2776-11-0x000007FEFA960000-0x000007FEFA9B0000-memory.dmp

Filesize
320KB

Download
memory/2776-16-0x000007FEFA960000-0x000007FEFA9B0000-memory.dmp

Filesize
320KB

Download
memory/2776-17-0x000007FEFA960000-0x000007FEFA9B0000-memory.dmp

Filesize
320KB

Download
memory/2776-22-0x000007FEFA960000-0x000007FEFA9B0000-memory.dmp

Filesize
320KB

Download