emotet | 0697826f6c0ca2ad11730de77fe6a57f26a43fca9a98e3c869bafb006ebee82b | Triage™

Analysis

max time kernel
119s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
22/03/2022, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0697826f6c0ca2ad11730de77fe6a57f26a43fca9a98e3c869bafb006ebee82b.dll
Size 1012KB
Sample220322-p73qesfbc9
SHA256 0697826f6c0ca2ad11730de77fe6a57f26a43fca9a98e3c869bafb006ebee82b
MD5 284d0aad6bc503759572abd4edaaef7a
SHA1 60eb64f0933da25e281621cc198311d4993082ab
SHA512 93d995ca45a901a0ae4a07deae98ca1447e18ab291f0170c0a9d6fc8a4bf32bca779d790f0ded702f5f68d6c0787679cd416574b059c943bdcfb9116c9e5d486
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4612	regsvr32.exe
4612	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4612	4556	regsvr32.exe	83
PID 4556 wrote to memory of 4612	4556	regsvr32.exe	83
PID 4556 wrote to memory of 4612	4556	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0697826f6c0ca2ad11730de77fe6a57f26a43fca9a98e3c869bafb006ebee82b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0697826f6c0ca2ad11730de77fe6a57f26a43fca9a98e3c869bafb006ebee82b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4612-134-0x0000000002B90000-0x0000000002BB8000-memory.dmp

Download