emotet | 49debe82b014bae8d3045f7759222d7a074fc41ff189f283ab687373480fcdd6 | Triage™

Analysis

max time kernel
133s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
22/02/2022, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
802sNhBm3mo939QqW7lZPqy9IChAAK.dll
Size 472KB
Sample220222-we78rsbgh4
SHA256 49debe82b014bae8d3045f7759222d7a074fc41ff189f283ab687373480fcdd6
MD5 4667b2153f09fa65afa519e6abba5fc9
SHA1 c53d474569a0d3c8efbe973936a0b5e7de91d5eb
SHA512 c36a47ca26f11eddf6ffabf157328ee559dd8eaddd3e48499a638a9c242b55341bf16e822d2a048007a00757121a190ac901987918fe287dd132677f8d21f3db
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3276	regsvr32.exe
3276	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 3276	3320	regsvr32.exe	59
PID 3320 wrote to memory of 3276	3320	regsvr32.exe	59
PID 3320 wrote to memory of 3276	3320	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\802sNhBm3mo939QqW7lZPqy9IChAAK.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\802sNhBm3mo939QqW7lZPqy9IChAAK.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-130-0x0000000004620000-0x0000000004646000-memory.dmp

Download