emotet | 24c2c23a0f65dc3684c67a4ee23e53f7e6750234f5f07ec13e956c82e3c8bce2 | Triage™

Analysis

max time kernel
128s
max time network
164s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bvUqdRhN.dll
Size 496KB
Sample220127-khnsraaabj
SHA256 24c2c23a0f65dc3684c67a4ee23e53f7e6750234f5f07ec13e956c82e3c8bce2
MD5 454dd4b3b178b13b3132344b4ce662d8
SHA1 bbd05634fc4b129765c99025cac52bef58d7f9c7
SHA512 5b25becef2a0b7ee0756b82774a19332a535e7b29f5ac15420e49e568476b07a97ba7ce1940cef611d6b0a6d40489889e5e379ce53282e438f7ff4bed45eb21f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2536	668	regsvr32.exe	69
PID 668 wrote to memory of 2536	668	regsvr32.exe	69
PID 668 wrote to memory of 2536	668	regsvr32.exe	69
PID 2536 wrote to memory of 3556	2536	regsvr32.exe	70
PID 2536 wrote to memory of 3556	2536	regsvr32.exe	70
PID 2536 wrote to memory of 3556	2536	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bvUqdRhN.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bvUqdRhN.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bvUqdRhN.dll",DllRegisterServer
    3⤵
    PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-119-0x00000000043C0000-0x00000000043E5000-memory.dmp

Download