emotet | 8dd42bae44b81a33bfe39deccb2fb33faef0d350feb33f826117dedbf1605d5b | Triage™

Analysis

max time kernel
133s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21/03/2022, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
543176db3e2a3e0a20282118eb4ca877.dll
Size 780KB
Sample220321-kl179aaghp
SHA256 8dd42bae44b81a33bfe39deccb2fb33faef0d350feb33f826117dedbf1605d5b
MD5 543176db3e2a3e0a20282118eb4ca877
SHA1 70f56791a6749f3f48427bd0f2c9ffb334e61e7d
SHA512 399669288b5b09de8d5cc44d15aa972595f7a276f99d94270bc545fe731c16eff93a83792369a77ce5d83a3add2b220e35d5ebb284be91177807926ea01d0f49
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	regsvr32.exe
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 1092	488	regsvr32.exe	79
PID 488 wrote to memory of 1092	488	regsvr32.exe	79
PID 488 wrote to memory of 1092	488	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\543176db3e2a3e0a20282118eb4ca877.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\543176db3e2a3e0a20282118eb4ca877.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-130-0x0000000002F10000-0x0000000002F37000-memory.dmp

Download