emotet | d12e91d65c3967b1707ce21bbdd746f83ea01c668c8957fa20aa57f396dcaec8 | Triage™

Analysis

max time kernel
117s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
28/02/2022, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59f90994dad791d57ec02f0bbc8bf8e8.dll
Size 512KB
Sample220228-a6cqaaebfj
SHA256 d12e91d65c3967b1707ce21bbdd746f83ea01c668c8957fa20aa57f396dcaec8
MD5 59f90994dad791d57ec02f0bbc8bf8e8
SHA1 0aaa1788530c033dd76ead59fe1cc30ff49341ad
SHA512 157d171204594f7c769da308a52e0bc1e7aabad382b620f09c7a8da6ba6d072bf8d68b8a1b77f9255b12558d596e55279131e4dba69e759af3f1bee103949275
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Extracted

Family

emotet

C2

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3636	regsvr32.exe
3636	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3636	3604	regsvr32.exe	58
PID 3604 wrote to memory of 3636	3604	regsvr32.exe	58
PID 3604 wrote to memory of 3636	3604	regsvr32.exe	58

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59f90994dad791d57ec02f0bbc8bf8e8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\59f90994dad791d57ec02f0bbc8bf8e8.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3636-130-0x0000000004EA0000-0x0000000004EC8000-memory.dmp

Download