emotet | 19c7a2fc32db5c850dc7b016d4da19b3b0054b7af4cdad4d5e5795ff62d431dd | Triage™

Analysis

max time kernel
119s
max time network
125s
platform
windows10_x64
resource
win10-en-20211014
submitted
02/12/2021, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1gX.dll
Size 745KB
Sample211202-lw8kraecdj
SHA256 19c7a2fc32db5c850dc7b016d4da19b3b0054b7af4cdad4d5e5795ff62d431dd
MD5 1d12e5f1a2b2f606b976d5428ffe2605
SHA1 1519a204e8599ff93bf62bc3b80ed2a1a6ee1f80
SHA512 9bb8704f747e1a64bec1ec3352bfe048231b6bc7965755ba124e24abcd42c902bc5608659177ecb399a53bb5b093a1cee50152784a99bcea9c36d67e1df17dfc
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3456	3144	regsvr32.exe	69
PID 3144 wrote to memory of 3456	3144	regsvr32.exe	69
PID 3144 wrote to memory of 3456	3144	regsvr32.exe	69
PID 3456 wrote to memory of 4092	3456	regsvr32.exe	70
PID 3456 wrote to memory of 4092	3456	regsvr32.exe	70
PID 3456 wrote to memory of 4092	3456	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1gX.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1gX.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1gX.dll",DllRegisterServer
    3⤵
    PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3456-117-0x0000000010000000-0x0000000010027000-memory.dmp

Download