emotet | c4e3db57b6ba8228f896717cbed0777bca133f1352c25517cc97ad0a3a19b032 | Triage™

Analysis

max time kernel
95s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lTyn6Tz5.dll
Size 705KB
Sample220126-v27ebafghk
SHA256 c4e3db57b6ba8228f896717cbed0777bca133f1352c25517cc97ad0a3a19b032
MD5 7c1765f1a9a74fcca3e15822b89f837e
SHA1 03e87528e095c5ff5993b358c9a9e89b94bb1b69
SHA512 ea0c56b5c7ecdc3a42112d3f3ca1baaa18a5fd897a3fecc7caa3d1da5c13d5d7bbe7593d82415e672fd9a14415cda41c5d96362b6b606b489279384f34b2ad02
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 2772	3840	regsvr32.exe	69
PID 3840 wrote to memory of 2772	3840	regsvr32.exe	69
PID 3840 wrote to memory of 2772	3840	regsvr32.exe	69
PID 2772 wrote to memory of 864	2772	regsvr32.exe	70
PID 2772 wrote to memory of 864	2772	regsvr32.exe	70
PID 2772 wrote to memory of 864	2772	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lTyn6Tz5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\lTyn6Tz5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\lTyn6Tz5.dll",DllRegisterServer
    3⤵
    PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-115-0x0000000000AC0000-0x0000000000AE5000-memory.dmp

Download