emotet | 2995862500f39cd0ae48820013993fa63a352f614d7caa0286543b2c765b9527 | Triage™

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
21/01/2022, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ssd.dll
Size 612KB
Sample220121-wva8zaahcm
SHA256 2995862500f39cd0ae48820013993fa63a352f614d7caa0286543b2c765b9527
MD5 8b3d88fba8ae4db5abd7a1dffe455bbb
SHA1 d94940ab67d598d3d33a6d8a6d86e28af17f2faf
SHA512 7365255a1d27dc80a7d5cec8076d288140997c575f9e0aa936bdf8c5bed3edd258801c791bb9fc56ca741e25a4aa3f0b90fd7a3ef20badd8bcf5a0298adb7090
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2776	2496	regsvr32.exe	68
PID 2496 wrote to memory of 2776	2496	regsvr32.exe	68
PID 2496 wrote to memory of 2776	2496	regsvr32.exe	68
PID 2776 wrote to memory of 2912	2776	regsvr32.exe	69
PID 2776 wrote to memory of 2912	2776	regsvr32.exe	69
PID 2776 wrote to memory of 2912	2776	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ssd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ssd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ssd.dll",DllRegisterServer
    3⤵
    PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-115-0x0000000000DA0000-0x0000000000DC6000-memory.dmp

Download