emotet | e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552 | Triage™

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552.dll
Size 1004KB
Sample220322-qdstssfdb3
SHA256 e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552
MD5 00408cca71bb6341798538a2f59ee46c
SHA1 7f2f14e3a3ee09c79f93079fdcfe54aaed3747ce
SHA512 42fb51c77d4350d2d4c73d1439ca839b2add7b01ab60d18f93fea27178cb4b7dc19d3b95d67289cd5706eba73fb9cd3aa9b21bfb7e50fd4d9f2b60694b60e3ed
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3268	regsvr32.exe
3268	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3268	2800	regsvr32.exe	79
PID 2800 wrote to memory of 3268	2800	regsvr32.exe	79
PID 2800 wrote to memory of 3268	2800	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-130-0x0000000002E80000-0x0000000002EA7000-memory.dmp

Download