emotet | a7ab6f790baea2744db8f729bf811f1bcd580395b5f12f4be8f962bc124121be

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe
Size 61KB
Sample260928-tec2hsys9l
SHA256 a7ab6f790baea2744db8f729bf811f1bcd580395b5f12f4be8f962bc124121be
MD5 4e7fdaa13abd68caf58167a16bb21c5c
SHA1 5b94c790d226bcad4dd3b657cd1fb34d86c21c2a
SHA512 8b10e6b28d95d0f46388ea1b59eb9f140e7873846d3cc181d4158e9e200676359863d165b5d4d0ef426ac23ba911d7cae5bed723ae3343ab2e987918bd0a1465
SSDEEP 1536:8G3AOeY7isrj3XckPBqkM8STvPvIYZ+d0Tdj1SboCVN3:Vv7isPXckzSLQYZNhR83
TLSH
T12B538E13D70BC0BDF783407E7A1B75B742293D391161A9AEBE8B958898207D176E1F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker epoch3 discovery emotet trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

222.239.249.166:443
217.26.163.82:7080
91.205.173.54:8080
163.172.97.112:8080
103.205.177.229:80
176.58.93.123:80
212.112.113.235:80
201.196.15.79:990
193.34.144.138:8080
172.104.70.207:8080
104.238.80.237:8080
181.44.166.242:80
119.159.150.176:443
5.189.148.98:8080
139.162.185.116:443
190.189.79.73:80
78.46.87.133:8080
192.241.220.183:8080
23.253.207.142:8080
216.70.88.55:8080
172.245.13.50:8080
162.144.46.90:8080
95.216.207.86:7080
124.150.175.129:8080
124.150.175.133:80
216.75.37.196:8080
181.197.108.171:443
152.169.32.143:8080
187.177.155.123:990
50.116.78.109:8080
95.216.212.157:8080
143.95.101.72:8080
46.105.131.68:8080
192.163.221.191:8080
198.57.217.170:8080
138.197.140.163:8080
46.17.6.116:8080
195.201.56.68:7080
37.59.24.25:8080
191.100.24.201:50000
212.129.14.27:8080
51.38.134.203:8080
113.52.135.33:7080
181.47.235.26:993
177.226.25.78:80
142.93.87.198:8080
83.169.33.157:8080
157.7.164.178:8081
191.82.28.224:80

rsa_pubkey.plain

Signatures

Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	speedgroup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	speedgroup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	speedgroup.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	speedgroup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	speedgroup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	speedgroup.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	speedgroup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	speedgroup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	speedgroup.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe
4956	speedgroup.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3504	2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3504	4988	2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe	88
PID 3104 wrote to memory of 4956	3104	speedgroup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\2026-09-28_4e7fdaa13abd68caf58167a16bb21c5c_elex_emotet_maze.exe
  --8c561b8e
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:3504

C:\Windows\SysWOW64\speedgroup.exe
"C:\Windows\SysWOW64\speedgroup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\speedgroup.exe
  --de82204a
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3504-0-0x0000000000DE0000-0x0000000000DF4000-memory.dmp

Download