emotet | 55137d30c6e8639f33bf54c954069dcdd82d4e2e22b183f70f941c129d173905 | Triage™

Analysis

max time kernel
121s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
02/03/2022, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61e4795a9847bb4d1e9dd69c642708f2.dll
Size 494KB
Sample220302-chal5adgdn
SHA256 55137d30c6e8639f33bf54c954069dcdd82d4e2e22b183f70f941c129d173905
MD5 61e4795a9847bb4d1e9dd69c642708f2
SHA1 ccd76ee7062906b0e9e61dba603c30192df7634e
SHA512 ec048a022278ba0996f3092882653c2142747a4b4cf76a29c01e7fdfb58f3253e66a8301f2499bcde161bb0bcfa1c3f9b74cffc1c955ad9870009d4de487090f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3540	regsvr32.exe
3540	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3540	1812	regsvr32.exe	57
PID 1812 wrote to memory of 3540	1812	regsvr32.exe	57
PID 1812 wrote to memory of 3540	1812	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61e4795a9847bb4d1e9dd69c642708f2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61e4795a9847bb4d1e9dd69c642708f2.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-133-0x0000000010000000-0x0000000010028000-memory.dmp

Download