emotet | 71cd13bddb8a686493e1fd4859d8491082fd33e14a5b1dcc83c691746bb920a1 | Triage™

Analysis

max time kernel
131s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16/03/2022, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5c666f6f0f40e0e42bfb7f0d7692b03.dll
Size 736KB
Sample220316-v5fe1adfhp
SHA256 71cd13bddb8a686493e1fd4859d8491082fd33e14a5b1dcc83c691746bb920a1
MD5 b5c666f6f0f40e0e42bfb7f0d7692b03
SHA1 75bba4abeab408824461a8d73dbfd31bfa5a8b77
SHA512 f60d79526476841b4a8ea7d0a4d0f51fa0dc4da86b1300db8675674492630aa4f5151b6adc2bea268ec4e6f92c7402c3eefa444c167d9f788e93d23154f460d9
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	regsvr32.exe
1556	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1556	1460	regsvr32.exe	79
PID 1460 wrote to memory of 1556	1460	regsvr32.exe	79
PID 1460 wrote to memory of 1556	1460	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b5c666f6f0f40e0e42bfb7f0d7692b03.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b5c666f6f0f40e0e42bfb7f0d7692b03.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-130-0x0000000000BA0000-0x0000000000BD5000-memory.dmp

Download