emotet | 74ddfc732b61473839faaf083d3fb654fe0622fc862f08b91fee7f0210a86309 | Triage™

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21/03/2022, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16f0c6a54fde894a314d6ac4289015e9.dll
Size 504KB
Sample220321-ndp2ssbfd5
SHA256 74ddfc732b61473839faaf083d3fb654fe0622fc862f08b91fee7f0210a86309
MD5 16f0c6a54fde894a314d6ac4289015e9
SHA1 f0753192d6120bc26f780cfdcd5ed7052839f7aa
SHA512 3c010c435055e4445687c1716bca1bdf84de3cef696aba247b2ed90ef8bd87f476a15c44e892a768b369e858608a9a4dc14c658abe428433e7563efe6b2f55a4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	regsvr32.exe
1752	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1752	1996	regsvr32.exe	78
PID 1996 wrote to memory of 1752	1996	regsvr32.exe	78
PID 1996 wrote to memory of 1752	1996	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16f0c6a54fde894a314d6ac4289015e9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\16f0c6a54fde894a314d6ac4289015e9.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-130-0x0000000000990000-0x00000000009B8000-memory.dmp

Download