emotet | 6493bb4e51025dfe2d334a6bf3a9d73ecf0cf49e6dd516b574b0a719079f4dd1

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6493bb4e51025dfe2d334a6bf3a9d73ecf0cf49e6dd516b574b0a719079f4dd1.dll
Size

413KB
MD5

b83a927a0824c44ab612f265f3f07018
SHA1

15117876fc59d138a8b3e4865854c88924ff6de5
SHA256

6493bb4e51025dfe2d334a6bf3a9d73ecf0cf49e6dd516b574b0a719079f4dd1
SHA512

34f6fe9dcb0c9ec13919743263b212d98c39f67750d2d6122d977615cfc3be627cd69b2d7843639911d6bdc222ed08a5d17c8d601dad67954c0079d4bddd49dd
SSDEEP

6144:N/uf2XTixvh7bbWNVbrEqI1z96n9fNgE54zVR71p9I:NW+257yMF1zgtGe4zK

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3056 regsvr32.exe
2200 regsvr32.exe
2200 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3056 regsvr32.exe

pid	process
3056	regsvr32.exe
2200	regsvr32.exe
2200	regsvr32.exe

pid	process
3056	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3056 wrote to memory of 2200	3056	regsvr32.exe	regsvr32.exe
PID 3056 wrote to memory of 2200	3056	regsvr32.exe	regsvr32.exe
PID 3056 wrote to memory of 2200	3056	regsvr32.exe	regsvr32.exe
PID 3056 wrote to memory of 2200	3056	regsvr32.exe	regsvr32.exe
PID 3056 wrote to memory of 2200	3056	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6493bb4e51025dfe2d334a6bf3a9d73ecf0cf49e6dd516b574b0a719079f4dd1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VfAbfgNbIyfEjIQ\CYrjxmutZZn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-8-0x000007FEF7DC0000-0x000007FEF7E2C000-memory.dmp

Filesize
432KB

Download
memory/2200-11-0x000007FEF7DC0000-0x000007FEF7E2C000-memory.dmp

Filesize
432KB

Download
memory/3056-0-0x0000000180000000-0x000000018002E000-memory.dmp

Filesize
184KB

Download
memory/3056-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3056-7-0x000007FEF7DC0000-0x000007FEF7E2C000-memory.dmp

Filesize
432KB

Download