emotet | 48f1899b4b66118e81f3171d7e592c7a3a7bb5180cbf11fdd23ca1534b2bb70d

Analysis

max time kernel
144s
max time network
161s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_48f1899b4b66118e81f3171d7e592c7a3a7bb5180cbf11fdd23ca1534b2bb70d.dll
Size

880.9MB
MD5

31d81db15b66a6508e62a66d93c0fdba
SHA1

a5160a353ec360a4c7bdd9dc8d157fe3c2da5f0e
SHA256

48f1899b4b66118e81f3171d7e592c7a3a7bb5180cbf11fdd23ca1534b2bb70d
SHA512

738648b1853162d97792e9c6504439e3a3f39a2657826814d0ab0845c9b6e047697867d4353660ba4c9081619cf3bebeac6fbc2b9c1f86cadff68a5138b4b1c6
SSDEEP

12582912:KgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgBwgB:KZZZZZZZZZZZZZZZZZZZZZZZ7

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1668	regsvr32.exe
2628	regsvr32.exe
2628	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1668	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2628	1668	regsvr32.exe	31
PID 1668 wrote to memory of 2628	1668	regsvr32.exe	31
PID 1668 wrote to memory of 2628	1668	regsvr32.exe	31
PID 1668 wrote to memory of 2628	1668	regsvr32.exe	31
PID 1668 wrote to memory of 2628	1668	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_48f1899b4b66118e81f3171d7e592c7a3a7bb5180cbf11fdd23ca1534b2bb70d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NhsWUANKDgL\kVlYsUfoNI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1668-1-0x0000000001E30000-0x0000000001E8A000-memory.dmp

Filesize
360KB

Download
memory/1668-9-0x0000000180000000-0x00000001800F5000-memory.dmp

Filesize
980KB

Download
memory/2628-10-0x0000000180000000-0x00000001800F5000-memory.dmp

Filesize
980KB

Download
memory/2628-13-0x0000000180000000-0x00000001800F5000-memory.dmp

Filesize
980KB

Download
memory/2628-14-0x0000000180000000-0x00000001800F5000-memory.dmp

Filesize
980KB

Download