emotet | 9f2ef79c44b0bea1235e5082022ecaf61a8056cddf124261513eceff54973014 | Triage™

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
01/03/2022, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ab8410ff8fbf25b5fa6dc1dc8c1f288.dll
Size 494KB
Sample220301-s9b72aaeg9
SHA256 9f2ef79c44b0bea1235e5082022ecaf61a8056cddf124261513eceff54973014
MD5 5ab8410ff8fbf25b5fa6dc1dc8c1f288
SHA1 e75bf157b1d9ea023a11aa4eb8ede90b8c4b4b3d
SHA512 a6cb9a7757da033e0f7153ec7061ea36d1f14423635020efb82328b3da9ea111a5653157ead564c88447b76b2d63e3b4a9df9feac03c569d34807ef9d923e10f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1616	regsvr32.exe
1616	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1616	2296	regsvr32.exe	59
PID 2296 wrote to memory of 1616	2296	regsvr32.exe	59
PID 2296 wrote to memory of 1616	2296	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ab8410ff8fbf25b5fa6dc1dc8c1f288.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ab8410ff8fbf25b5fa6dc1dc8c1f288.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download