emotet | 59f30fdd15ba8562e1e882ace16c1a6a7845bf467aa0e53ce6f63b7f62390fa2

Analysis

max time kernel
152s
max time network
201s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-11-18/Backdoor.Win32.Emotet.exe
Size 72KB
Sample260915-y7ajbazzfs
SHA256 59f30fdd15ba8562e1e882ace16c1a6a7845bf467aa0e53ce6f63b7f62390fa2
MD5 2ffe22eb2829a05e50fc513a49791920
SHA1 e7b4c28e73f79bd12bc25fe85cae7983650c57c8
SHA512 aef09444859e52f2fb14c1718b36435e03dcc511c214f9895833fa7a27b11e4e6bfd560bb6c4a1edc4daefe65bd759ddcbc689c097f912f2a084b2c779bdbbdf
SSDEEP 768:C0Zzo2xDoZm3DAZvExxyl5FgupK5YVNfDi9nk0mrxae9R5UT6Arws+Od2iN:1Z0iAZUx8JUY3Di91md79R5m6Aw2d2i
TLSH
T17373BF07FBAE84F2E562593118BA7B762A37B8262F50479F5388EC1D42315C1AD2334F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker epoch3 discovery emotet trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

112.78.142.170:80
178.128.14.92:8080
178.238.232.46:443
185.142.236.163:443
192.210.217.94:8080
192.241.220.183:8080
105.209.235.113:8080
182.187.139.200:8080
188.0.135.237:80
201.213.177.139:80
31.146.61.34:80
202.5.47.71:80
81.17.93.134:80
192.163.221.191:8080
97.104.107.190:80
201.235.10.215:80
181.114.114.203:80
51.38.201.19:7080
46.32.229.152:8080
177.144.130.105:443
188.251.213.180:443
91.83.93.103:443
118.70.15.19:8080
197.83.232.19:80
195.201.56.70:8080
172.105.78.244:8080
177.37.81.212:443
172.96.190.154:8080
177.32.8.85:80
107.161.30.122:8080
175.29.183.2:80
86.57.216.23:80
185.86.148.68:443
198.57.203.63:8080
115.79.195.246:80
177.94.227.143:80
50.116.78.109:8080
181.134.9.162:80
92.24.51.238:80
197.249.6.179:443
87.106.231.60:8080
41.185.29.128:8080
78.189.60.109:443
81.214.253.80:443
77.74.78.80:443
105.213.67.88:80
143.95.101.72:8080
60.125.114.64:443
115.78.11.155:80
71.57.180.213:80
139.59.12.63:8080
203.153.216.178:7080
190.190.15.20:80
37.46.129.215:8080
190.53.144.120:80
203.153.216.182:7080
139.99.157.213:8080
86.98.143.163:80
178.33.167.120:8080
113.161.148.81:80
66.61.94.36:80
74.208.173.91:8080
157.7.164.178:8081
190.212.140.6:80
217.199.160.224:8080
46.105.131.68:8080
185.208.226.142:8080
179.62.238.49:80
179.5.118.12:80
216.75.37.196:8080
181.113.229.139:443
190.164.75.175:80
212.112.113.235:80
5.79.70.250:8080
75.127.14.170:8080

rsa_pubkey.plain

Signatures

Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 4 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral14/memory/2576-4-0x0000000000A50000-0x0000000000A59000-memory.dmp	emotet
behavioral14/memory/2576-0-0x00000000022C0000-0x00000000022CC000-memory.dmp	emotet
behavioral14/memory/4368-6-0x0000000000A00000-0x0000000000A0C000-memory.dmp	emotet
behavioral14/memory/4368-10-0x0000000000A00000-0x0000000000A0C000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

pid	Process
4368	camext.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MPG4DECD\camext.exe	Backdoor.Win32.Emotet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5992	2576	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Backdoor.Win32.Emotet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	camext.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe
4368	camext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2576	Backdoor.Win32.Emotet.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2576	Backdoor.Win32.Emotet.exe
2576	Backdoor.Win32.Emotet.exe
4368	camext.exe
4368	camext.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4368	2576	Backdoor.Win32.Emotet.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-11-18\Backdoor.Win32.Emotet.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-18\Backdoor.Win32.Emotet.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\MPG4DECD\camext.exe
  "C:\Windows\SysWOW64\MPG4DECD\camext.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 968
  2⤵
  - Program crash
  PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2576 -ip 2576
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

camext.exe

Path C:\Windows\SysWOW64\MPG4DECD\camext.exe
Size 72KB
SHA256 59f30fdd15ba8562e1e882ace16c1a6a7845bf467aa0e53ce6f63b7f62390fa2
MD5 2ffe22eb2829a05e50fc513a49791920
SHA1 e7b4c28e73f79bd12bc25fe85cae7983650c57c8
SHA512 aef09444859e52f2fb14c1718b36435e03dcc511c214f9895833fa7a27b11e4e6bfd560bb6c4a1edc4daefe65bd759ddcbc689c097f912f2a084b2c779bdbbdf
SSDEEP 768:C0Zzo2xDoZm3DAZvExxyl5FgupK5YVNfDi9nk0mrxae9R5UT6Arws+Od2iN:1Z0iAZUx8JUY3Di91md79R5m6Aw2d2i
TLSH
T17373BF07FBAE84F2E562593118BA7B762A37B8262F50479F5388EC1D42315C1AD2334F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-4-0x0000000000A50000-0x0000000000A59000-memory.dmp

Download

memory/2576-0-0x00000000022C0000-0x00000000022CC000-memory.dmp

Download

memory/2576-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4368-6-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Download

memory/4368-10-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Download