emotet | ff2e162f536a5a0dd8873af395cfcf3b18b2a78833008e209c7140b5a4471953 | Triage™

Analysis

max time kernel
144s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16/03/2022, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f0e4dfd97a9abcc9202c0bbbfd7edef.dll
Size 664KB
Sample220316-smbb8afaf2
SHA256 ff2e162f536a5a0dd8873af395cfcf3b18b2a78833008e209c7140b5a4471953
MD5 5f0e4dfd97a9abcc9202c0bbbfd7edef
SHA1 3ccfa1a2a82769bf79a9d64295bf731132d52314
SHA512 b7d4ca73d11b52f2fc60c99128b5eb207fb5e237193aea2d19cf1fe61d5536c1a49156bfc4c3d24d1edf2e9c2dd4be018c34a4a5df798e90107ee06cd2b919f2
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
444	regsvr32.exe
444	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 444	380	regsvr32.exe	80
PID 380 wrote to memory of 444	380	regsvr32.exe	80
PID 380 wrote to memory of 444	380	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5f0e4dfd97a9abcc9202c0bbbfd7edef.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5f0e4dfd97a9abcc9202c0bbbfd7edef.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-130-0x0000000002E80000-0x0000000002EB5000-memory.dmp

Download