emotet | dcdd60351659eb01c55bf55f442c7819d747e735a7236ad1f8fca41ba3f190ad | Triage™

Analysis

max time kernel
91s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
22/02/2022, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88b4d61544dd130b53f97d931ce8910d.dll
Size 500KB
Sample220222-2askeaeed7
SHA256 dcdd60351659eb01c55bf55f442c7819d747e735a7236ad1f8fca41ba3f190ad
MD5 88b4d61544dd130b53f97d931ce8910d
SHA1 f7e67d8c0fe289187a6b4a2df28299de2c0069f8
SHA512 e2260dba7072c247fad60be61b974ca951e0bb7c96167124cfc478993ffa4010ffe70397a5cf0bbffbab9bccad4eb7fbe4f7dd2db25228d5fc54c1837fe86733
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3944	regsvr32.exe
3944	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3944	3704	regsvr32.exe	58
PID 3704 wrote to memory of 3944	3704	regsvr32.exe	58
PID 3704 wrote to memory of 3944	3704	regsvr32.exe	58

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88b4d61544dd130b53f97d931ce8910d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\88b4d61544dd130b53f97d931ce8910d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3944-131-0x0000000004600000-0x0000000004626000-memory.dmp

Download