emotet | 84b9ddf43c4fcd4ee504b5f12b8fa30ea95e96da6737e6354f46bc6737bea7c0 | Triage™

Analysis

max time kernel
132s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
23/02/2022, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea1894722b1126745973121447bad34d.dll
Size 1.1MB
Sample220223-rraqtabgek
SHA256 84b9ddf43c4fcd4ee504b5f12b8fa30ea95e96da6737e6354f46bc6737bea7c0
MD5 ea1894722b1126745973121447bad34d
SHA1 64b7035e53da1ad01c506bd85643795cc08ad280
SHA512 7dc4d9e99053ff210bc8dd133d27b03d368c63656756696b87e5140ae3f47a560a6eeeb02c9f46cc745fe97847e3861d900dbe12c3e073dc306b48f8daf634f5
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	regsvr32.exe
4628	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4628	4388	regsvr32.exe	81
PID 4388 wrote to memory of 4628	4388	regsvr32.exe	81
PID 4388 wrote to memory of 4628	4388	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ea1894722b1126745973121447bad34d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ea1894722b1126745973121447bad34d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4628-130-0x0000000002550000-0x0000000002576000-memory.dmp

Download