emotet | d8ba8a2d17e14faa5d82da08cd03956754a491d3384bef93310ac92fad50f260 | Triage™

Analysis

max time kernel
136s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
04/03/2022, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b73024fd4894ddc745268ad532a8b780.dll
Size 611KB
Sample220304-af4fbadac9
SHA256 d8ba8a2d17e14faa5d82da08cd03956754a491d3384bef93310ac92fad50f260
MD5 b73024fd4894ddc745268ad532a8b780
SHA1 6b538c86a75a4a954b7fa52d8829a402c90485a2
SHA512 644d502f0e5a9d8c502346444b9460cb6ecb573783f5c8feea50ba8eb7af26a01eeadf488090ae60d1ceb940c05367254858a9ba02327b9b01786e5d7dc3edce
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	regsvr32.exe
892	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 892	608	regsvr32.exe	78
PID 608 wrote to memory of 892	608	regsvr32.exe	78
PID 608 wrote to memory of 892	608	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b73024fd4894ddc745268ad532a8b780.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b73024fd4894ddc745268ad532a8b780.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-130-0x0000000010000000-0x0000000010027000-memory.dmp

Download