emotet | 605caa36fd0091e1cff09df1586bd2705a8fa0dc7a17e38e523e78f50b62b591

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

605caa36fd0091e1cff09df1586bd2705a8fa0dc7a17e38e523e78f50b62b591.dll
Size

887KB
MD5

ccf6f89cf6c763fb4002f16c97237a54
SHA1

c618860316eeac2676cd63489794fffbfb014e90
SHA256

605caa36fd0091e1cff09df1586bd2705a8fa0dc7a17e38e523e78f50b62b591
SHA512

f2e15de87e58936a0a7fb89e66acd1d81d5b7995888bc4f181b355dd1f177013e6d27846126214456d357711f5bdb69b89bf65f025852ff8a213531a648b8e5d
SSDEEP

12288:A0BQgtzAxM8q6BkmkxisTsxwJzCQ6TZ56lu4Vp4y1F9SFXCwQjbk:Ar6zAxVq6Bkm7saIzCXTZxUJFcS

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	Process
1892	regsvr32.exe
2748	regsvr32.exe
2748	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid	Process
1892	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 1892 wrote to memory of 2748	1892	regsvr32.exe	30
PID 1892 wrote to memory of 2748	1892	regsvr32.exe	30
PID 1892 wrote to memory of 2748	1892	regsvr32.exe	30
PID 1892 wrote to memory of 2748	1892	regsvr32.exe	30
PID 1892 wrote to memory of 2748	1892	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\605caa36fd0091e1cff09df1586bd2705a8fa0dc7a17e38e523e78f50b62b591.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FowEfqX\aMMtMp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-0-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/1892-3-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1892-7-0x0000000180000000-0x00000001800E4000-memory.dmp

Filesize
912KB

Download
memory/2748-8-0x0000000180000000-0x00000001800E4000-memory.dmp

Filesize
912KB

Download
memory/2748-11-0x0000000180000000-0x00000001800E4000-memory.dmp

Filesize
912KB

Download
memory/2748-18-0x0000000180000000-0x00000001800E4000-memory.dmp

Filesize
912KB

Download