emotet | 77a1f4d90bc3f27aecfdc00062e9f4b8e625b6dcf629ba78a6f93de6464e2aff | Triage™

Analysis

max time kernel
132s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
22/03/2022, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77a1f4d90bc3f27aecfdc00062e9f4b8e625b6dcf629ba78a6f93de6464e2aff.dll
Size 1004KB
Sample220322-qaywmsbfdq
SHA256 77a1f4d90bc3f27aecfdc00062e9f4b8e625b6dcf629ba78a6f93de6464e2aff
MD5 01b386a1aebac18d8f2930ccd392ddef
SHA1 5f596da641fa8d114f2d3b0a5430a3cc0c3eca26
SHA512 3392b89689b59265c4e0acadee1bb9ac367e5a570e5fc58c3b0921f7e36cb2a1e73bac3e5893e57b7d836f48f0b890dcbd7ada38c95e458e3e488cba2268ebfc
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
808	regsvr32.exe
808	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 808	1016	regsvr32.exe	82
PID 1016 wrote to memory of 808	1016	regsvr32.exe	82
PID 1016 wrote to memory of 808	1016	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77a1f4d90bc3f27aecfdc00062e9f4b8e625b6dcf629ba78a6f93de6464e2aff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\77a1f4d90bc3f27aecfdc00062e9f4b8e625b6dcf629ba78a6f93de6464e2aff.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-134-0x0000000002C00000-0x0000000002C27000-memory.dmp

Download