emotet | d3bd116d2d9404d7db8e0d3bdf20e01913d12f477b0cb4d92770667a862cbbf1 | Triage™

Analysis

max time kernel
85s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
28/02/2022, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa58dc54c29c76754ea70aaf753e8df0.dll
Size 512KB
Sample220228-hx9bwsdee6
SHA256 d3bd116d2d9404d7db8e0d3bdf20e01913d12f477b0cb4d92770667a862cbbf1
MD5 fa58dc54c29c76754ea70aaf753e8df0
SHA1 ca13b8b50cc636ccacb4063d705c33a540fefb5a
SHA512 0b368f8af645339a0674802798026058be526f02834c71698e93996f461226b05f20afbd0b9a695e8530dbb93b9411f2bb9489a6bd715079e1927e18b5150d1f
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	regsvr32.exe
1844	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1844	4020	regsvr32.exe	59
PID 4020 wrote to memory of 1844	4020	regsvr32.exe	59
PID 4020 wrote to memory of 1844	4020	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fa58dc54c29c76754ea70aaf753e8df0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fa58dc54c29c76754ea70aaf753e8df0.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-130-0x0000000004C50000-0x0000000004C78000-memory.dmp

Download