emotet | e48b4b270845196a918e72a5ed293d4c0db49b760a76e4be3a5a515e8b124fe1 | Triage™

Analysis

max time kernel
111s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
18/03/2022, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3dcc8cf1714b181f32e1a9bc5ec3950d.dll
Size 664KB
Sample220318-vyqbmacec2
SHA256 e48b4b270845196a918e72a5ed293d4c0db49b760a76e4be3a5a515e8b124fe1
MD5 3dcc8cf1714b181f32e1a9bc5ec3950d
SHA1 e5824577251783c4742eea3042ff599246553970
SHA512 194e0174e09bce0a8a316f38ad08a3ec8b897577c8c077969adfd1f8430caa45ee0329da7967fb4d42484d5ae10034560d2845a6731bc0c558ba369bf0d54594
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1184	regsvr32.exe
1184	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1184	4652	regsvr32.exe	82
PID 4652 wrote to memory of 1184	4652	regsvr32.exe	82
PID 4652 wrote to memory of 1184	4652	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3dcc8cf1714b181f32e1a9bc5ec3950d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3dcc8cf1714b181f32e1a9bc5ec3950d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-134-0x0000000002A80000-0x0000000002AA8000-memory.dmp

Download