emotet | 305af9404a6faedb5e5f2e75d1d41eb38c6d69db6abbf8f84ae8de4a3f82bba2 | Triage™

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
03/03/2022, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f493f56c14bdd97d151c61b5f876189.dll
Size 615KB
Sample220303-1fwzcaecaj
SHA256 305af9404a6faedb5e5f2e75d1d41eb38c6d69db6abbf8f84ae8de4a3f82bba2
MD5 4f493f56c14bdd97d151c61b5f876189
SHA1 1bdc749e85351e83362fef73c6bb83a87b5f3500
SHA512 f52f35be586957eba23821a7251a8d2c858a06af6059de58f358593f5117e3abc369123e3eaf93c537aded51d30a770df8c1fbc119f4d314d290d3586ba0d5d4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
256	regsvr32.exe
256	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 256	3056	regsvr32.exe	57
PID 3056 wrote to memory of 256	3056	regsvr32.exe	57
PID 3056 wrote to memory of 256	3056	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4f493f56c14bdd97d151c61b5f876189.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4f493f56c14bdd97d151c61b5f876189.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/256-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download