emotet | db9545c9fc1e892aa58ff3c1248751ff7f167fe31ca53ff05d37592a5d27a0b7 | Triage™

Analysis

max time kernel
133s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
28/02/2022, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85a9099887762418b5a1f15d6bb755bd.dll
Size 512KB
Sample220228-b2y86aecck
SHA256 db9545c9fc1e892aa58ff3c1248751ff7f167fe31ca53ff05d37592a5d27a0b7
MD5 85a9099887762418b5a1f15d6bb755bd
SHA1 495dad8651ca983734cab3430a2e4416fac7d972
SHA512 2e037736609a18f55f4d881cdac9a72f057b2ef090cd6128c4e5b3fb62cc9ede591dc770de8a93da26d1cd77de14d6bcebe9cc20abb34b46be3a66941c518ece
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Extracted

Family

emotet

C2

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	regsvr32.exe
1244	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1244	1872	regsvr32.exe	79
PID 1872 wrote to memory of 1244	1872	regsvr32.exe	79
PID 1872 wrote to memory of 1244	1872	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\85a9099887762418b5a1f15d6bb755bd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\85a9099887762418b5a1f15d6bb755bd.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-130-0x0000000002CD0000-0x0000000002CF8000-memory.dmp

Download