emotet | c95723b5071ec0a0faf6ee44343b74acf32b4e92956a07307073cb6aaa040561 | Triage™

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c95723b5071ec0a0faf6ee44343b74acf32b4e92956a07307073cb6aaa040561.dll
Size 1004KB
Sample220322-qb442sfda4
SHA256 c95723b5071ec0a0faf6ee44343b74acf32b4e92956a07307073cb6aaa040561
MD5 0471919b12cd55a8fde419f8aa1e833a
SHA1 30174892f832588c10dd09b9b467cc6540124cf5
SHA512 c151aa3320cff0975c1a9527fb25c987c920594e482cf1d5f3a49734c36ddd44c6f7a596026422c8b1a6b73cec36db0d781b0d29fb47b1162cfa9b4802b7720a
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	regsvr32.exe
1684	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1684	1492	regsvr32.exe	80
PID 1492 wrote to memory of 1684	1492	regsvr32.exe	80
PID 1492 wrote to memory of 1684	1492	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c95723b5071ec0a0faf6ee44343b74acf32b4e92956a07307073cb6aaa040561.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c95723b5071ec0a0faf6ee44343b74acf32b4e92956a07307073cb6aaa040561.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-130-0x0000000000F10000-0x0000000000F37000-memory.dmp

Download