emotet | c781eec81c69da790f5c487c0b0560c5e855b1a659791a10418efcf5a6df20f5

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c781eec81c69da790f5c487c0b0560c5e855b1a659791a10418efcf5a6df20f5.dll
Size

649KB
MD5

e3e94de0812345ee337d710b8a03b783
SHA1

93444e1a79372cf353db0aa7bf7acc7710b46434
SHA256

c781eec81c69da790f5c487c0b0560c5e855b1a659791a10418efcf5a6df20f5
SHA512

a488d7e98d3eb4aa8aa8c744f9c89b7aaf630c5a6e4b7dc53c04b8d8931ea64c8105f93be84d2daf6c8f98d03ee41752c1572e431476fa24d6ceaf7661ba12a6
SSDEEP

12288:AZA6cc2TVra6d9aaNlm+TrzN2oYF1VC4NKy8YN6oQLYylOjTlTkZBVkU8QNGa:AZA6cc2Vd9aaOoQWZy8YYoQLYylbnkUJ

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

94.23.45.86:4143

129.232.188.93:443

213.241.20.155:443

197.242.150.244:8080

172.104.251.154:8080

46.55.222.11:443

82.223.21.224:8080

5.9.116.246:8080

1.234.2.232:8080

146.59.226.45:443

160.16.142.56:8080

115.68.227.76:8080

72.15.201.15:8080

188.44.20.25:443

185.4.135.165:8080

103.132.242.26:8080

173.212.193.249:8080

163.44.196.120:8080

183.111.227.137:8080

149.56.131.28:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4968	regsvr32.exe
4968	regsvr32.exe
2916	regsvr32.exe
2916	regsvr32.exe
2916	regsvr32.exe
2916	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4968	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2916	4968	regsvr32.exe	83
PID 4968 wrote to memory of 2916	4968	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c781eec81c69da790f5c487c0b0560c5e855b1a659791a10418efcf5a6df20f5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NRDQZOGhhbqtyS\QsApvOYAgv.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-9-0x00007FF8B5B90000-0x00007FF8B5D85000-memory.dmp

Filesize
2.0MB

Download
memory/2916-10-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2916-11-0x00007FF8B5B90000-0x00007FF8B5D85000-memory.dmp

Filesize
2.0MB

Download
memory/2916-13-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2916-24-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4968-0-0x0000000180000000-0x000000018002A000-memory.dmp

Filesize
168KB

Download
memory/4968-3-0x00007FF8B5B90000-0x00007FF8B5D85000-memory.dmp

Filesize
2.0MB

Download
memory/4968-4-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4968-8-0x00007FF8B5B90000-0x00007FF8B5D85000-memory.dmp

Filesize
2.0MB

Download