emotet | ae2785d78b7344f874035d76088ce78283cd28c252525c8de7e685001c04d491 | Triage™

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
02/03/2022, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d939a9fdee9ba74cd84ba9a6b7a023a6.dll
Size 494KB
Sample220302-at25eabhh8
SHA256 ae2785d78b7344f874035d76088ce78283cd28c252525c8de7e685001c04d491
MD5 d939a9fdee9ba74cd84ba9a6b7a023a6
SHA1 ce34bfe488df772fa1c2ad317529a9cab26761a1
SHA512 3581b4250c81e4c42c71078e7ccb3b9e6c32b036acf6d4fda2aa7119d0e5a21027e4d1d293959d953fa335c32b7748696cb9a928e0fa9bd9662cd06415c037c2
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	regsvr32.exe
2472	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2472	2256	regsvr32.exe	79
PID 2256 wrote to memory of 2472	2256	regsvr32.exe	79
PID 2256 wrote to memory of 2472	2256	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d939a9fdee9ba74cd84ba9a6b7a023a6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d939a9fdee9ba74cd84ba9a6b7a023a6.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download