emotet | ddc9eb2fe2521d0fb86453ef30854917a4100c80856e3b11579b7db811b0e85a

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddc9eb2fe2521d0fb86453ef30854917a4100c80856e3b11579b7db811b0e85a.dll
Size

516KB
MD5

a74f236cbd6bd46ce80b69d74431c1db
SHA1

98e8916e6ec435856495cfef19a8e98ad4f72656
SHA256

ddc9eb2fe2521d0fb86453ef30854917a4100c80856e3b11579b7db811b0e85a
SHA512

d3f46f7bdb153fc95c751c96b7cbde20e824be80a3e508425e2e97710ef5dee3c56d8d28a159dcec2e5705689b9c0aaf807919b497f0f66dcb1f291b8f8dde84
SSDEEP

6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXDn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXD

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
708	regsvr32.exe
1852	regsvr32.exe
1852	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
708	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 1852	708	regsvr32.exe	30
PID 708 wrote to memory of 1852	708	regsvr32.exe	30
PID 708 wrote to memory of 1852	708	regsvr32.exe	30
PID 708 wrote to memory of 1852	708	regsvr32.exe	30
PID 708 wrote to memory of 1852	708	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ddc9eb2fe2521d0fb86453ef30854917a4100c80856e3b11579b7db811b0e85a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QnSGiCO\tzMBgwqv.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/708-3-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/708-0-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download
memory/708-7-0x000007FEF7A50000-0x000007FEF7AD9000-memory.dmp

Filesize
548KB

Download
memory/1852-8-0x000007FEF7A50000-0x000007FEF7AD9000-memory.dmp

Filesize
548KB

Download
memory/1852-11-0x000007FEF7A50000-0x000007FEF7AD9000-memory.dmp

Filesize
548KB

Download
memory/1852-18-0x000007FEF7A50000-0x000007FEF7AD9000-memory.dmp

Filesize
548KB

Download