emotet | bd23d7ea4c814af04d3e6f77c8eb785fcbeaf1ee6af798aac8f1b7f168df984b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd23d7ea4c814af04d3e6f77c8eb785fcbeaf1ee6af798aac8f1b7f168df984b.dll
Size

176KB
MD5

8413c172dc2200a36802ed626b0999f8
SHA1

d4f257e753f2ff6b89c1433da7889ebd23c5ae5c
SHA256

bd23d7ea4c814af04d3e6f77c8eb785fcbeaf1ee6af798aac8f1b7f168df984b
SHA512

537e4eb76e26359e74f2144fdc648cab72b873170d2388f87640e0178936414ce2a4b18f8a7913eb64b58a70a4e04d34fa8903728d38ee8708d7d262b49c3896
SSDEEP

3072:VpjftMFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRqi1/wm//KgWeIkGwCN

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

94.23.45.86:4143

129.232.188.93:443

213.241.20.155:443

197.242.150.244:8080

172.104.251.154:8080

46.55.222.11:443

82.223.21.224:8080

5.9.116.246:8080

1.234.2.232:8080

146.59.226.45:443

160.16.142.56:8080

115.68.227.76:8080

72.15.201.15:8080

188.44.20.25:443

185.4.135.165:8080

103.132.242.26:8080

173.212.193.249:8080

163.44.196.120:8080

183.111.227.137:8080

149.56.131.28:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1996	regsvr32.exe
1996	regsvr32.exe
4284	regsvr32.exe
4284	regsvr32.exe
4284	regsvr32.exe
4284	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1996	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4284	1996	regsvr32.exe	85
PID 1996 wrote to memory of 4284	1996	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bd23d7ea4c814af04d3e6f77c8eb785fcbeaf1ee6af798aac8f1b7f168df984b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DoSHjhy\nSyuGzeeQaqTNM.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-3-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1996-0-0x0000000180000000-0x000000018002A000-memory.dmp

Filesize
168KB

Download
memory/1996-4-0x0000000065280000-0x00000000652B5000-memory.dmp

Filesize
212KB

Download
memory/4284-8-0x0000000065280000-0x00000000652B5000-memory.dmp

Filesize
212KB

Download