emotet | 307b1b9cb438f1470d7664300536d4f074c6607e5a2b1ef5cebca58d40dee62c | Triage™

Analysis

max time kernel
117s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 08:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4wvaTkGqn.dll
Size 496KB
Sample220127-kgjgmsaca6
SHA256 307b1b9cb438f1470d7664300536d4f074c6607e5a2b1ef5cebca58d40dee62c
MD5 d2fed5e1eac36623e1e12a8e4ed51c6e
SHA1 e4dd3d3b41eed253ce7d1cba86400c25e5519508
SHA512 671bae80d097b348c95249f596e0bc4f0ba3ee8ff4b101045200f2c7b1dbaf07fac6433e22e6c33712f47dd2dd6279ac5c1a55a1365bb4287a099df425483070
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2732	2420	regsvr32.exe	68
PID 2420 wrote to memory of 2732	2420	regsvr32.exe	68
PID 2420 wrote to memory of 2732	2420	regsvr32.exe	68
PID 2732 wrote to memory of 3740	2732	regsvr32.exe	69
PID 2732 wrote to memory of 3740	2732	regsvr32.exe	69
PID 2732 wrote to memory of 3740	2732	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4wvaTkGqn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4wvaTkGqn.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4wvaTkGqn.dll",DllRegisterServer
    3⤵
    PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-118-0x0000000004630000-0x0000000004655000-memory.dmp

Download