emotet | 9c01c0ca9db1898ced15005dddfa15f1d5b28e48c33199701b7d26d45724ff62

Analysis

max time kernel
140s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9c01c0ca9db1898ced15005dddfa15f1d5b28e48c33199701b7d26d45724ff62.dll
Size

416KB
MD5

64c9b29bca7f1523e2cd0c2a6b1a362c
SHA1

2b70bf019ef3d46543d770f998db827f98f1964e
SHA256

9c01c0ca9db1898ced15005dddfa15f1d5b28e48c33199701b7d26d45724ff62
SHA512

8c773be5efc3b50b8cb55ea51de626c0dd3af93f96496614181f95825b00a601869f599f8b60e93fdc9fbe1e0ae1af0638545095dd577784ac4052643773f671
SSDEEP

6144:AUfZtmwfeLXpvtw5pVDcMohByxzIM61G9aqhEvdMifFdRR5BPiGH0WUwRINcq:AGtmwWLvgpLoGxYIagEvdMiHvH0Qm

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

45.118.115.99:8080

189.126.111.200:7080

79.137.35.198:8080

103.43.46.182:443

102.222.215.74:443

103.70.28.102:8080

196.218.30.83:443

146.59.226.45:443

5.9.116.246:8080

164.68.99.3:8080

163.44.196.120:8080

167.99.115.35:8080

209.250.246.206:443

183.111.227.137:8080

46.55.222.11:443

45.235.8.30:8080

51.91.76.89:8080

107.182.225.142:8080

103.132.242.26:8080

45.176.232.124:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2704	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3052	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2704	3052	regsvr32.exe	30
PID 3052 wrote to memory of 2704	3052	regsvr32.exe	30
PID 3052 wrote to memory of 2704	3052	regsvr32.exe	30
PID 3052 wrote to memory of 2704	3052	regsvr32.exe	30
PID 3052 wrote to memory of 2704	3052	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9c01c0ca9db1898ced15005dddfa15f1d5b28e48c33199701b7d26d45724ff62.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IjImdeYozAsHZw\hxrTolKtPz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-8-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/3052-0-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/3052-3-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download