emotet | 76d736e8bbee012eaf4be9f3b0aaac66df2ef7bf5690dd425916842a30655dfa | Triage™

Analysis

max time kernel
114s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
03/03/2022, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cc3a8849c949539d1f61509101ee4a0.dll
Size 615KB
Sample220303-zl1daacea4
SHA256 76d736e8bbee012eaf4be9f3b0aaac66df2ef7bf5690dd425916842a30655dfa
MD5 1cc3a8849c949539d1f61509101ee4a0
SHA1 ba461b303c7040bc96cf392a86b246968fc9df84
SHA512 820ed5737e08af83139a234e96ae1a24a0cd85e2b42f5cc8261f958c7f741a82718845d5dd15255d0debf39a48b47ac48c36b99481fe9cb071f9d122d8ac6033
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3080	regsvr32.exe
3080	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3080	3064	regsvr32.exe	54
PID 3064 wrote to memory of 3080	3064	regsvr32.exe	54
PID 3064 wrote to memory of 3080	3064	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1cc3a8849c949539d1f61509101ee4a0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1cc3a8849c949539d1f61509101ee4a0.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3080-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download