emotet | 5d769c847620dfa77aeeb4d74ec57d79a5b58a8c8fe8e9d704f7b8f50a9beff1 | Triage™

Analysis

max time kernel
137s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d769c847620dfa77aeeb4d74ec57d79a5b58a8c8fe8e9d704f7b8f50a9beff1.dll
Size 1012KB
Sample220322-p73qesfbc5
SHA256 5d769c847620dfa77aeeb4d74ec57d79a5b58a8c8fe8e9d704f7b8f50a9beff1
MD5 6c0cbd7c6c793d8bc307b629c2cfda36
SHA1 9f9476f2e7c44ae5ca7febd4af7269ce4617b219
SHA512 4cb587397ef22ae2b09d8c15eb9f485ce7800246237f6187748eb9fed7be407f79573b9153b454db68428e8040e1f1745ced9c844cc644a004593f47bf911a37
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2172	regsvr32.exe
2172	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2172	1996	regsvr32.exe	78
PID 1996 wrote to memory of 2172	1996	regsvr32.exe	78
PID 1996 wrote to memory of 2172	1996	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d769c847620dfa77aeeb4d74ec57d79a5b58a8c8fe8e9d704f7b8f50a9beff1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d769c847620dfa77aeeb4d74ec57d79a5b58a8c8fe8e9d704f7b8f50a9beff1.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-130-0x0000000001600000-0x0000000001628000-memory.dmp

Download