emotet | 4fde87a8e2f7e76c5bca4fa412d2a2da056367a32ce79aec8c91a83d143481c8 | Triage™

Analysis

max time kernel
126s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16/03/2022, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7442b86172be6bcff59a1f476927be0d.dll
Size 732KB
Sample220316-1l3dbafbdl
SHA256 4fde87a8e2f7e76c5bca4fa412d2a2da056367a32ce79aec8c91a83d143481c8
MD5 7442b86172be6bcff59a1f476927be0d
SHA1 71801870b999b1f8873c727af568f658f9ea2424
SHA512 ffa27128a7c8a182a4902aad391158d6cf6a742d535d7446614b14268abefa62f903c13bf467e0e2e002314f37f077533406be9e983544059e3a2f27dde977c1
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
660	regsvr32.exe
660	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 660	4316	regsvr32.exe	80
PID 4316 wrote to memory of 660	4316	regsvr32.exe	80
PID 4316 wrote to memory of 660	4316	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7442b86172be6bcff59a1f476927be0d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7442b86172be6bcff59a1f476927be0d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-131-0x0000000002D10000-0x0000000002D44000-memory.dmp

Download