emotet | 283fbcc4d0cfe39badfaad9eb5f6880a0dbcf99271835af695cba0ce88d680ac | Triage™

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
24/02/2022, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e52deac3587fe645735bce547964a24d.dll
Size 664KB
Sample220224-a7g2dsdadk
SHA256 283fbcc4d0cfe39badfaad9eb5f6880a0dbcf99271835af695cba0ce88d680ac
MD5 e52deac3587fe645735bce547964a24d
SHA1 eb7f605d711649e8929d578db295e06284ed56f7
SHA512 8399f93b1333d4d1ad662f00329680f179fae1c6a98130b71d4a59e54d8f1005fe843b93ab48129cee4bee93365fcfa7f3ec213ba2aad9718ab3957a8dd6ca5a
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2332	regsvr32.exe
2332	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2332	1768	regsvr32.exe	81
PID 1768 wrote to memory of 2332	1768	regsvr32.exe	81
PID 1768 wrote to memory of 2332	1768	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e52deac3587fe645735bce547964a24d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e52deac3587fe645735bce547964a24d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-130-0x0000000002970000-0x0000000002996000-memory.dmp

Download