emotet | e9549cda3ff6cee4db504c97480e69c31d45536434a8c649702ce847857fcce9 | Triage™

Analysis

max time kernel
147s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1ozx9A.dll
Size 504KB
Sample220127-kg362saca7
SHA256 e9549cda3ff6cee4db504c97480e69c31d45536434a8c649702ce847857fcce9
MD5 8fa925acaac27cad0cb4b4dd648d8a0c
SHA1 5aa44d29f1bfdf99e85cd3fdd742a4f812ba5fec
SHA512 71b7d215d42942021c92356f79a0837f6a0710cc3c161c94a8e1a75fd0ae8df3fbe102de2c13e7e15ce50949854494799ba38e60aab5540563b3d4d1c2c15f9f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3700	2592	regsvr32.exe	69
PID 2592 wrote to memory of 3700	2592	regsvr32.exe	69
PID 2592 wrote to memory of 3700	2592	regsvr32.exe	69
PID 3700 wrote to memory of 1308	3700	regsvr32.exe	70
PID 3700 wrote to memory of 1308	3700	regsvr32.exe	70
PID 3700 wrote to memory of 1308	3700	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b1ozx9A.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b1ozx9A.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b1ozx9A.dll",DllRegisterServer
    3⤵
    PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3700-115-0x00000000047C0000-0x00000000047E7000-memory.dmp

Download