emotet | c741c99d012dc3f2ecb4057129d8f5d7f66fe2c75c087ce5f3faa6c5eaea3f92

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe
Size 71KB
Sample260523-2bb9tabv9p
SHA256 c741c99d012dc3f2ecb4057129d8f5d7f66fe2c75c087ce5f3faa6c5eaea3f92
MD5 41081c3631cf782a6b41cd3e4a71d875
SHA1 f25f1cb56f372f370106eef2b4b00c6f16c2e61a
SHA512 cf2124ffdb324bd29886186aa47840d5bf67101d032ba971c4a4991c44e19cf33912e0ab2359213a683a2c12501ed2e3d288c70bc186fff92fbddaba7ebb5244
SSDEEP 1536:oSQpv/ns4Q6UxkPWrbvkM8qLv1ASGZq4nvM6cCrc5hf8ILVV2MKF6F+:pQns4UxkesgASGZtM6VKVa6F+
TLSH
T1D163AE02E34FD1BEF682807E751776BB512439392171A9AEFB879988B4507D032E1F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker epoch2 discovery emotet trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

173.247.19.238:80
174.81.132.128:80
211.44.35.111:80
165.227.156.155:443
167.99.105.223:7080
67.225.179.64:8080
176.31.200.130:8080
104.131.11.150:8080
68.118.26.116:80
190.226.44.20:21
120.150.246.241:80
92.222.216.44:8080
73.214.99.25:80
110.142.38.16:80
24.93.212.32:80
190.53.135.159:21
66.209.97.122:8080
173.91.11.142:80
100.14.117.137:80
2.237.76.249:80
104.137.176.186:80
47.6.15.79:80
62.75.187.192:8080
47.156.70.145:80
201.173.217.124:443
104.131.44.150:8080
186.75.241.230:80
31.131.182.30:80
107.170.24.125:8080
110.143.84.202:80
75.80.148.244:80
186.67.208.78:8080
104.236.246.93:8080
45.51.40.140:80
45.33.49.124:443
74.105.102.97:8080
70.46.247.81:80
59.103.164.174:80
110.143.57.109:80
31.31.77.83:443
192.241.255.77:8080
195.244.215.206:80
144.139.247.220:80
103.86.49.11:8080
61.197.110.214:80
91.242.138.5:443
101.187.134.207:443
73.11.153.178:8080
190.12.119.180:443
5.196.74.210:8080
209.141.54.221:8080
169.239.182.217:8080
2.38.99.79:80
197.254.221.174:80
85.72.180.68:80
179.13.185.19:80
183.102.238.69:465
149.202.153.252:8080
64.53.242.181:8080
2.235.190.23:8080
174.77.190.137:8080
182.176.132.213:8090
167.71.10.37:8080
138.59.177.106:443
218.44.21.114:80
46.105.131.87:80
87.230.19.21:8080
37.157.194.134:443
83.136.245.190:8080
178.210.51.222:8080
108.179.206.219:8080
93.147.141.5:80
178.209.71.63:8080
64.147.15.138:80
12.176.19.218:80
128.65.154.183:443
108.191.2.72:80
217.160.182.191:8080
37.59.24.177:8080
78.24.219.147:8080
212.64.171.206:80
87.106.136.232:8080
211.63.71.72:8080
81.0.63.86:8080
80.21.182.46:80
210.6.85.121:80
188.152.7.140:80
206.189.112.148:8080
70.175.171.251:80
190.147.215.53:22
212.129.24.79:8080
98.24.231.64:80
189.209.217.49:80
91.73.197.90:80
116.48.142.21:443
209.97.168.52:8080
181.57.193.14:80
73.176.241.255:80
173.12.14.133:8080
139.130.241.252:443
200.7.243.108:443
85.152.174.56:80
165.228.24.197:80
159.65.25.128:8080
176.106.183.253:8080
5.88.182.250:80
59.148.227.190:80
31.172.240.91:8080
58.171.42.66:8080
91.205.215.66:443
1.33.230.137:80
82.155.161.203:80
95.128.43.213:8080
47.6.15.79:443
201.184.105.242:443
86.98.156.239:443
190.220.19.82:443
66.34.201.20:7080
87.106.139.101:8080
50.116.86.205:8080
5.154.58.24:80
201.251.133.92:443
101.187.247.29:80
206.81.10.215:8080
60.40.74.197:80

rsa_pubkey.plain

Signatures

Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pdfmethods.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pdfmethods.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pdfmethods.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	pdfmethods.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfmethods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfmethods.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pdfmethods.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pdfmethods.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pdfmethods.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe
3700	pdfmethods.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2740	2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2740	3564	2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe	87
PID 2480 wrote to memory of 3700	2480	pdfmethods.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\2026-05-23_41081c3631cf782a6b41cd3e4a71d875_elex_emotet_maze.exe
  --6d52a1f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:2740

C:\Windows\SysWOW64\pdfmethods.exe
"C:\Windows\SysWOW64\pdfmethods.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\pdfmethods.exe
  --904977f2
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-0-0x0000000001000000-0x0000000001017000-memory.dmp

Download