emotet | ffce5ea574adc0916f0020ab12bb0fb91eb9ce745978a1da3b62b07f1b1fde4a

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffce5ea574adc0916f0020ab12bb0fb91eb9ce745978a1da3b62b07f1b1fde4a.dll
Size

356KB
MD5

315ee75bfeb4a7f00764177d84def882
SHA1

068eb6baa4d1017f65a8c7f0c0a012e845689d13
SHA256

ffce5ea574adc0916f0020ab12bb0fb91eb9ce745978a1da3b62b07f1b1fde4a
SHA512

e008cc6cd8e4c285b905f983b4cc90f51986e7a4faf8ce94bd918394d6bdb8cee9dc9929af45580498fa750b8472f8f29ed3b6e13f05fc05a7a249a928714a52
SSDEEP

3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTF0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TkRIvgMSS3AyUrhYu3j

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

212.24.98.99:8080

51.91.76.89:8080

94.23.45.86:4143

101.50.0.91:8080

103.43.75.120:443

212.237.17.99:8080

158.69.222.101:443

51.254.140.238:7080

1.234.2.232:8080

91.207.28.33:8080

167.172.253.162:8080

45.235.8.30:8080

115.68.227.76:8080

134.122.66.193:8080

89.29.244.7:443

197.242.150.244:8080

164.68.99.3:8080

5.9.116.246:8080

1.234.21.73:7080

131.100.24.231:80

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1552	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1968	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1552	1968	regsvr32.exe	31
PID 1968 wrote to memory of 1552	1968	regsvr32.exe	31
PID 1968 wrote to memory of 1552	1968	regsvr32.exe	31
PID 1968 wrote to memory of 1552	1968	regsvr32.exe	31
PID 1968 wrote to memory of 1552	1968	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ffce5ea574adc0916f0020ab12bb0fb91eb9ce745978a1da3b62b07f1b1fde4a.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MPjwHTjX\UjfyEmCCVa.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-8-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/1552-9-0x000007FEF7940000-0x000007FEF799F000-memory.dmp

Filesize
380KB

Download
memory/1552-11-0x000007FEF7940000-0x000007FEF799F000-memory.dmp

Filesize
380KB

Download
memory/1552-12-0x000007FEF7940000-0x000007FEF799F000-memory.dmp

Filesize
380KB

Download
memory/1552-18-0x000007FEF7940000-0x000007FEF799F000-memory.dmp

Filesize
380KB

Download
memory/1552-20-0x000007FEF7940000-0x000007FEF799F000-memory.dmp

Filesize
380KB

Download
memory/1552-21-0x000007FEF7940000-0x000007FEF799F000-memory.dmp

Filesize
380KB

Download
memory/1968-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1968-1-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/1968-4-0x000007FEF79A0000-0x000007FEF79FF000-memory.dmp

Filesize
380KB

Download