emotet | b4a4fcfff70cc0109a87a93a7a10940f5fbeecc936bdf6ceb4425657b9b921b5

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a4fcfff70cc0109a87a93a7a10940f5fbeecc936bdf6ceb4425657b9b921b5.dll
Size

405KB
MD5

9224b483a9de4f83bd9799dac4994ab8
SHA1

65153fd651b27f971961cb2ea5542f2a2f1482a9
SHA256

b4a4fcfff70cc0109a87a93a7a10940f5fbeecc936bdf6ceb4425657b9b921b5
SHA512

84697774d60bc65c541f1f65bc65432472204c5b93056eda52e39fb789d700f02de7952c094feff0b4d4a1bde0807a19e00b194bcc4f6e997a6a8b38f7241169
SSDEEP

12288:M3hV6Pw4aT23s2oRd9zi3BBoNIQ/hsA7:Yb6Pw4R3s2ki3fUZh

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

51.254.140.238:7080

103.70.28.102:8080

5.9.116.246:8080

1.234.2.232:8080

209.250.246.206:443

58.227.42.236:80

72.15.201.15:8080

159.65.88.10:8080

189.126.111.200:7080

173.212.193.249:8080

188.44.20.25:443

134.122.66.193:8080

172.104.251.154:8080

103.75.201.2:443

150.95.66.124:8080

153.126.146.25:7080

103.43.75.120:443

203.114.109.124:443

27.54.89.58:8080

1.234.21.73:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid	Process
1724	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid	Process
1716	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 1716 wrote to memory of 1724	1716	regsvr32.exe	28
PID 1716 wrote to memory of 1724	1716	regsvr32.exe	28
PID 1716 wrote to memory of 1724	1716	regsvr32.exe	28
PID 1716 wrote to memory of 1724	1716	regsvr32.exe	28
PID 1716 wrote to memory of 1724	1716	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b4a4fcfff70cc0109a87a93a7a10940f5fbeecc936bdf6ceb4425657b9b921b5.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XqilaByJxFY\yNpBvgBTmcEkuCk.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1716-1-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/1716-4-0x000007FEF6AD0000-0x000007FEF6B3C000-memory.dmp

Filesize
432KB

Download
memory/1724-8-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/1724-9-0x000007FEF6A60000-0x000007FEF6ACC000-memory.dmp

Filesize
432KB

Download
memory/1724-11-0x000007FEF6A60000-0x000007FEF6ACC000-memory.dmp

Filesize
432KB

Download
memory/1724-12-0x000007FEF6A60000-0x000007FEF6ACC000-memory.dmp

Filesize
432KB

Download
memory/1724-18-0x000007FEF6A60000-0x000007FEF6ACC000-memory.dmp

Filesize
432KB

Download
memory/1724-20-0x000007FEF6A60000-0x000007FEF6ACC000-memory.dmp

Filesize
432KB

Download
memory/1724-21-0x000007FEF6A60000-0x000007FEF6ACC000-memory.dmp

Filesize
432KB

Download