emotet | cdfdf4e3b144b4bc00fcdf46bd60efdf13895bcd4443c709b4f72492cb28e0cb | Triage™

Analysis

max time kernel
85s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
25/01/2022, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qOQyN5jP.dll
Size 660KB
Sample220125-vdez6abdd9
SHA256 cdfdf4e3b144b4bc00fcdf46bd60efdf13895bcd4443c709b4f72492cb28e0cb
MD5 e7236af3be07fc1fdf99bdc3dd34688e
SHA1 b24a670bd34c80696aba2561f96b86ac7ef01296
SHA512 9dfa65dd8e157ae1de071d32fc2dec23c9d2865ba9785153d16588d68d05bc1d5fdd0023946023c44caab27f24ea0fc9043f2941535fdc3d12ec9205786af363
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2000	3932	regsvr32.exe	69
PID 3932 wrote to memory of 2000	3932	regsvr32.exe	69
PID 3932 wrote to memory of 2000	3932	regsvr32.exe	69
PID 2000 wrote to memory of 1664	2000	regsvr32.exe	70
PID 2000 wrote to memory of 1664	2000	regsvr32.exe	70
PID 2000 wrote to memory of 1664	2000	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\qOQyN5jP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\qOQyN5jP.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\qOQyN5jP.dll",DllRegisterServer
    3⤵
    PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-116-0x0000000004370000-0x0000000004395000-memory.dmp

Download