emotet | 75e1d758d04cfbc9e35e75ac2df6f7221f49b7f326bd0b3b81d2c5237c418484 | Triage™

Analysis

max time kernel
102s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
23/02/2022, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dQ5M7o45ZyfSrwmq0zWUTdb20yee.dll
Size 1.1MB
Sample220223-p476qsbeak
SHA256 75e1d758d04cfbc9e35e75ac2df6f7221f49b7f326bd0b3b81d2c5237c418484
MD5 2882acc2a2c54011d505b613c5da6e12
SHA1 d1db3f1594304ed112b6080c367d41a66208ba78
SHA512 8439711ccab054d74bf5a469dda6407fd865e0a70af94f337183459593e01487d941862a0c277457e8dc3847c1b8f0ed6fea0a2bef1ad3d8182996c335885306
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	regsvr32.exe
1996	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1996	1796	regsvr32.exe	57
PID 1796 wrote to memory of 1996	1796	regsvr32.exe	57
PID 1796 wrote to memory of 1996	1796	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dQ5M7o45ZyfSrwmq0zWUTdb20yee.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dQ5M7o45ZyfSrwmq0zWUTdb20yee.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-130-0x0000000004540000-0x0000000004566000-memory.dmp

Download