emotet | e793e5d6d09666bd1039136ca897e8e4b645cfafab63384be7f5abcc8aa10990 | Triage™

Analysis

max time kernel
122s
max time network
139s
platform
windows10_x64
resource
win10-en-20211208
submitted
30/01/2022, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
H9Y5.dll
Size 538KB
Sample220130-rjfl4acbfm
SHA256 e793e5d6d09666bd1039136ca897e8e4b645cfafab63384be7f5abcc8aa10990
MD5 25358e76114ce8e2a0d94a86ffa16d21
SHA1 44434fc817b4a916ec2c04359f607328647f94f0
SHA512 571162405acc0a741d02d1ef5099458176d9208f87eb5059a8a603f2f600607a3c941c7e4b8993116b8ae73c57eb2cf57e9c658f969e8d9f09b7839b45fad8aa
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3644	3540	regsvr32.exe	68
PID 3540 wrote to memory of 3644	3540	regsvr32.exe	68
PID 3540 wrote to memory of 3644	3540	regsvr32.exe	68
PID 3644 wrote to memory of 3820	3644	regsvr32.exe	69
PID 3644 wrote to memory of 3820	3644	regsvr32.exe	69
PID 3644 wrote to memory of 3820	3644	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\H9Y5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\H9Y5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\H9Y5.dll",DllRegisterServer
    3⤵
    PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-118-0x00000000049B0000-0x00000000049D5000-memory.dmp

Download