emotet | 217fdfe1a56bce7bcbf7b5c314d6e2796acc6aa0b96f86ca195ecaa7101bc7e2 | Triage™

Analysis

max time kernel
133s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
217fdfe1a56bce7bcbf7b5c314d6e2796acc6aa0b96f86ca195ecaa7101bc7e2.dll
Size 588KB
Sample220322-qj5esafea3
SHA256 217fdfe1a56bce7bcbf7b5c314d6e2796acc6aa0b96f86ca195ecaa7101bc7e2
MD5 9836d82ced841a9e22fdaa0876c9d5fe
SHA1 8ab93eb9bcf836705445935146ab699d1d1dd7d7
SHA512 14ac41db57d8eff9861d09bc340e16ed02c222e238e38745ba47566777ee0b1d8ac522966f63fc443bd64a2c095696ce70086b29942ebea1c85dd0cbc9c0c0cf
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	regsvr32.exe
1540	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1540	1416	regsvr32.exe	80
PID 1416 wrote to memory of 1540	1416	regsvr32.exe	80
PID 1416 wrote to memory of 1540	1416	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\217fdfe1a56bce7bcbf7b5c314d6e2796acc6aa0b96f86ca195ecaa7101bc7e2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\217fdfe1a56bce7bcbf7b5c314d6e2796acc6aa0b96f86ca195ecaa7101bc7e2.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-130-0x0000000003050000-0x0000000003078000-memory.dmp

Download