emotet | 18d34d902e116cfd32069a5e410cbdfecae29c35c0c63a11542eabf066fbe7f8 | Triage™

Analysis

max time kernel
123s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
04/03/2022, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b867cc09ad4b8b739c0200f81ac6f1bf.dll
Size 615KB
Sample220304-jxp4paead6
SHA256 18d34d902e116cfd32069a5e410cbdfecae29c35c0c63a11542eabf066fbe7f8
MD5 b867cc09ad4b8b739c0200f81ac6f1bf
SHA1 60fb1c52c76e15136d9c67474457f62f2bf61bbe
SHA512 ec2fdb7bdcd3403d9a8a823aab64d0220ca438449633bc53b7c4cbb3be9ff173acda406888719695ff266d887ef8f8f6697dd93a5e16c2d77f17cb1bcfc5022f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3940	regsvr32.exe
3940	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3940	1208	regsvr32.exe	56
PID 1208 wrote to memory of 3940	1208	regsvr32.exe	56
PID 1208 wrote to memory of 3940	1208	regsvr32.exe	56

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b867cc09ad4b8b739c0200f81ac6f1bf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b867cc09ad4b8b739c0200f81ac6f1bf.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-133-0x0000000010000000-0x0000000010028000-memory.dmp

Download