emotet | 6cb5c3a0ea7dec228b27cfd06530a6f948dfd74e5d9e5b9919fc616c59470d43 | Triage™

Analysis

max time kernel
140s
max time network
179s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BFRwB.dll
Size 544KB
Sample220128-ws7t6aaahn
SHA256 6cb5c3a0ea7dec228b27cfd06530a6f948dfd74e5d9e5b9919fc616c59470d43
MD5 79776f0748f0245ef8c94e9061b51282
SHA1 5a6288ee16e52337d1735692ecef47094f834d4a
SHA512 161c51ba7e326b8dda91667ff976151621317fa180b4569ff186d7d8002275439bd530976c267756b6c0c4a1a598823a72c58662856da72b9fab41fda443e533
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2776	2308	regsvr32.exe	69
PID 2308 wrote to memory of 2776	2308	regsvr32.exe	69
PID 2308 wrote to memory of 2776	2308	regsvr32.exe	69
PID 2776 wrote to memory of 1492	2776	regsvr32.exe	72
PID 2776 wrote to memory of 1492	2776	regsvr32.exe	72
PID 2776 wrote to memory of 1492	2776	regsvr32.exe	72

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\BFRwB.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\BFRwB.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BFRwB.dll",DllRegisterServer
    3⤵
    PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-115-0x0000000000A70000-0x0000000000A97000-memory.dmp

Download