emotet | b1e2bbd01c11a5b1de72efc5dfe7a9f81678a64909507f8f9c6a8b7be26c63cd | Triage™

Analysis

max time kernel
123s
max time network
140s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KSo.dll
Size 496KB
Sample220127-khn4hsacb9
SHA256 b1e2bbd01c11a5b1de72efc5dfe7a9f81678a64909507f8f9c6a8b7be26c63cd
MD5 6f9b61ff9928b7606858ed2ed16cb01e
SHA1 00a9117591fbc846c71ca1db13330db6e0084ff4
SHA512 313adadc95f02d85136ef1a64d47d0e95d062e0e9d9c33c2de79cba01134538dfcc4192d570711085251401786e7b889711570dab2792ff7c980e9429b9cf44f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3500	3620	regsvr32.exe	68
PID 3620 wrote to memory of 3500	3620	regsvr32.exe	68
PID 3620 wrote to memory of 3500	3620	regsvr32.exe	68
PID 3500 wrote to memory of 3964	3500	regsvr32.exe	69
PID 3500 wrote to memory of 3964	3500	regsvr32.exe	69
PID 3500 wrote to memory of 3964	3500	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\KSo.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\KSo.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\KSo.dll",DllRegisterServer
    3⤵
    PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3500-118-0x00000000048B0000-0x00000000048D5000-memory.dmp

Download