emotet | 486bf5b303f865f8645397a8259ce2eb25317adca53138b2febcf36002759e2e | Triage™

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
486bf5b303f865f8645397a8259ce2eb25317adca53138b2febcf36002759e2e.dll
Size 1004KB
Sample220322-qay7eabfdr
SHA256 486bf5b303f865f8645397a8259ce2eb25317adca53138b2febcf36002759e2e
MD5 1701ca4bcab165170097f11912293112
SHA1 334df839259294dad89b01423e2987b211f5cf27
SHA512 1c657947a85f894bff9cd2af3d30d0a11bd4fe2fadbbc74b856c46163cc9c5cde4981b332d50d4f4f6b014f8ce2249ebec91b5c288ce7aba562e5750f5b5ec7c
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	regsvr32.exe
2068	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2068	1936	regsvr32.exe	78
PID 1936 wrote to memory of 2068	1936	regsvr32.exe	78
PID 1936 wrote to memory of 2068	1936	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\486bf5b303f865f8645397a8259ce2eb25317adca53138b2febcf36002759e2e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\486bf5b303f865f8645397a8259ce2eb25317adca53138b2febcf36002759e2e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-130-0x0000000000A70000-0x0000000000A97000-memory.dmp

Download