emotet | 8fdf7f4912ecf224662f60a3dfa5172b6ba82694664cee1c7a1e75b3dff46d51

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fdf7f4912ecf224662f60a3dfa5172b6ba82694664cee1c7a1e75b3dff46d51.dll
Size

740KB
MD5

1520c5c38f90016f7b9ed1c221178267
SHA1

40a35657c88fb7e8648fd81de12109d96a021c7d
SHA256

8fdf7f4912ecf224662f60a3dfa5172b6ba82694664cee1c7a1e75b3dff46d51
SHA512

14ec8c098d95b568d686fd9260df85095abcffc502d9d6647c953464aff14037130d9a9171cf24a561e47d63163a09692eea7219942d01844801a9de3cfc4cfe
SSDEEP

12288:e+GedJbn7eOaMrvbn1ndVFM9r4GVqvHMN7prpH3VTTQLpLcXJuJvrMS90aRCxgeV:e+GedJveOaMrvr1nnUN7dpH3VgN4XJ4u

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.254.140.238:7080

103.70.28.102:8080

5.9.116.246:8080

1.234.2.232:8080

209.250.246.206:443

58.227.42.236:80

72.15.201.15:8080

159.65.88.10:8080

189.126.111.200:7080

173.212.193.249:8080

188.44.20.25:443

134.122.66.193:8080

172.104.251.154:8080

103.75.201.2:443

150.95.66.124:8080

153.126.146.25:7080

103.43.75.120:443

203.114.109.124:443

27.54.89.58:8080

1.234.21.73:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2248	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2248	1620	regsvr32.exe	31
PID 1620 wrote to memory of 2248	1620	regsvr32.exe	31
PID 1620 wrote to memory of 2248	1620	regsvr32.exe	31
PID 1620 wrote to memory of 2248	1620	regsvr32.exe	31
PID 1620 wrote to memory of 2248	1620	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8fdf7f4912ecf224662f60a3dfa5172b6ba82694664cee1c7a1e75b3dff46d51.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UoCHwlz\DZzOXESIgbHRcw.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/1620-3-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1620-4-0x000007FEF7150000-0x000007FEF720F000-memory.dmp

Filesize
764KB

Download
memory/2248-5-0x000007FEF6B60000-0x000007FEF6C1F000-memory.dmp

Filesize
764KB

Download
memory/2248-10-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/2248-11-0x000007FEF6B60000-0x000007FEF6C1F000-memory.dmp

Filesize
764KB

Download
memory/2248-14-0x000007FEF6B60000-0x000007FEF6C1F000-memory.dmp

Filesize
764KB

Download
memory/2248-15-0x000007FEF6B60000-0x000007FEF6C1F000-memory.dmp

Filesize
764KB

Download
memory/2248-20-0x000007FEF6B60000-0x000007FEF6C1F000-memory.dmp

Filesize
764KB

Download