emotet | c34e40a8ef0071257b130c092cf4d7e684dcc82d5dbfb17e9fcbc147dd04691e | Triage™

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
03/03/2022, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fce55935fae3d76f4b7ac05c99784bd.dll
Size 615KB
Sample220303-zl1daacea3
SHA256 c34e40a8ef0071257b130c092cf4d7e684dcc82d5dbfb17e9fcbc147dd04691e
MD5 7fce55935fae3d76f4b7ac05c99784bd
SHA1 1c6f40ca0e89127cf8c601313a6f2c32f1f7754a
SHA512 90da7b0860734c8fa9ed4703ac6fa7841a5e726742773b1888673b93a971dde2bb490915af7299e90743e61ca91fbb5d4f6f02ab4011de98100225a748f274a9
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1552	regsvr32.exe
1552	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1552	1868	regsvr32.exe	56
PID 1868 wrote to memory of 1552	1868	regsvr32.exe	56
PID 1868 wrote to memory of 1552	1868	regsvr32.exe	56

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7fce55935fae3d76f4b7ac05c99784bd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7fce55935fae3d76f4b7ac05c99784bd.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download