emotet | 86a2a74f668bba4cbf15fd484f3a408094138b233dc5ad9cb1581cfc50d06e73

Analysis

max time kernel
146s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86a2a74f668bba4cbf15fd484f3a408094138b233dc5ad9cb1581cfc50d06e73.dll
Size

580KB
MD5

8b50e7039a24b1a71aee63f096023fb2
SHA1

42c205430c3d6de51761e3bcb514b7dc20f918f8
SHA256

86a2a74f668bba4cbf15fd484f3a408094138b233dc5ad9cb1581cfc50d06e73
SHA512

732adc94f2c4413f4d59f2b14f8a81b6d5c74b1b6a83af207d4c615494f12804bb53d4f7a22750674da345b9b15ed743404a0dde8cd223295696b2536960352d
SSDEEP

12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZY9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2UyyrmY9MoIA3n

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080

146.59.226.45:443

51.91.76.89:8080

209.97.163.214:443

158.69.222.101:443

82.165.152.127:8080

103.70.28.102:8080

72.15.201.15:8080

150.95.66.124:8080

45.176.232.124:443

82.223.21.224:8080

107.170.39.149:8080

160.16.142.56:8080

103.132.242.26:8080

153.126.146.25:7080

213.241.20.155:443

1.234.21.73:7080

197.242.150.244:8080

188.44.20.25:443

196.218.30.83:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid	Process
2408	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid	Process
2408	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 1648	2408	regsvr32.exe	31
PID 2408 wrote to memory of 1648	2408	regsvr32.exe	31
PID 2408 wrote to memory of 1648	2408	regsvr32.exe	31
PID 2408 wrote to memory of 1648	2408	regsvr32.exe	31
PID 2408 wrote to memory of 1648	2408	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\86a2a74f668bba4cbf15fd484f3a408094138b233dc5ad9cb1581cfc50d06e73.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ImvjlAmEFoTUYT\jSzWmWhVoYe.dll"
  2⤵
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-16-0x00000000003D0000-0x000000000047A000-memory.dmp

Filesize
680KB

Download
memory/1648-18-0x00000000003D0000-0x000000000047A000-memory.dmp

Filesize
680KB

Download
memory/2408-0-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2408-2-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download
memory/2408-11-0x0000000180000000-0x000000018002B000-memory.dmp

Filesize
172KB

Download
memory/2408-14-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2408-15-0x0000000000210000-0x00000000002BA000-memory.dmp

Filesize
680KB

Download