emotet | e772d21483274a6a7311c0ca4e469c96b6022903d88786f3aab1377a7cc70eed

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e772d21483274a6a7311c0ca4e469c96b6022903d88786f3aab1377a7cc70eed.dll
Size

784KB
MD5

36e87ae9472eb4dc57d387a50f0b0c83
SHA1

df2dcf91b5d1c39ea3cf752bbf72d11c6834a9be
SHA256

e772d21483274a6a7311c0ca4e469c96b6022903d88786f3aab1377a7cc70eed
SHA512

6c24462549cce617a50b7496069ddc72756579f6162f87007315d94167fb795b19302510e20a0cac3b79b91fe55ef7fcaaa68ead405b521a10a2a3c8e443350c
SSDEEP

24576:3VG7+UC48smUGuW5EnEqJfNaPLJrSd/fCYyTMtM:FGCUVJlaPpS5fCYyTMy

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

194.9.172.107:8080

66.42.57.149:443

165.22.73.229:8080

202.29.239.162:443

104.248.225.227:8080

54.38.242.185:443

103.133.214.242:8080

78.47.204.80:443

210.57.209.142:8080

103.41.204.169:8080

118.98.72.86:443

88.217.172.165:8080

87.106.97.83:7080

85.25.120.45:8080

195.77.239.39:8080

37.44.244.177:8080

36.67.23.59:443

160.16.143.191:7080

54.38.143.246:7080

159.69.237.188:443

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2940	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1960	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2940	1960	regsvr32.exe	30
PID 1960 wrote to memory of 2940	1960	regsvr32.exe	30
PID 1960 wrote to memory of 2940	1960	regsvr32.exe	30
PID 1960 wrote to memory of 2940	1960	regsvr32.exe	30
PID 1960 wrote to memory of 2940	1960	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e772d21483274a6a7311c0ca4e469c96b6022903d88786f3aab1377a7cc70eed.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QyfzXoEpWST\QVpjsTKspighV.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-1-0x0000000001C60000-0x0000000001C91000-memory.dmp

Filesize
196KB

Download
memory/1960-0-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1960-4-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download
memory/2940-8-0x0000000000230000-0x0000000000261000-memory.dmp

Filesize
196KB

Download
memory/2940-9-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download
memory/2940-11-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download
memory/2940-12-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download
memory/2940-18-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download
memory/2940-20-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download
memory/2940-21-0x0000000180000000-0x00000001800CD000-memory.dmp

Filesize
820KB

Download