emotet | aec14bcb72b5717d69cdaace1b450adfc7b60eb47bdb75cab254c8e8ad4d26f4 | Triage™

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
02/03/2022, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c093722fbaae5c7a070e116c6c94603.dll
Size 604KB
Sample220302-3ff91aacbl
SHA256 aec14bcb72b5717d69cdaace1b450adfc7b60eb47bdb75cab254c8e8ad4d26f4
MD5 6c093722fbaae5c7a070e116c6c94603
SHA1 a3b002e027a9bdce602873e30188748df9a94a76
SHA512 231d351c85433e00d850f5dc2041b88e147bc8ee53193a3a56eae0c3b3343162077b77cbf4fbc31425449bfad463925272aa52ee8b976cc159018f22c39ca2e3
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
956	regsvr32.exe
956	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 956	484	regsvr32.exe	79
PID 484 wrote to memory of 956	484	regsvr32.exe	79
PID 484 wrote to memory of 956	484	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c093722fbaae5c7a070e116c6c94603.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6c093722fbaae5c7a070e116c6c94603.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-130-0x00000000025E0000-0x0000000002607000-memory.dmp

Download