emotet | e4056edf1bdf53c9bc92b51eb973c243437fb2ab478b0d3e4641730a39cb3faa | Triage™

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
22/03/2022, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e4056edf1bdf53c9bc92b51eb973c243437fb2ab478b0d3e4641730a39cb3faa.dll
Size 600KB
Sample220322-qqxcraffb9
SHA256 e4056edf1bdf53c9bc92b51eb973c243437fb2ab478b0d3e4641730a39cb3faa
MD5 99c137adc9f326be4951ca34ef087b4e
SHA1 6f32bff0eb30cd00886ec4ecd3b9d40315e2f285
SHA512 e8c31af313616d9ffbdeb4b5f0f3f46efce9f95dc480076bc75d05b0bb4a94c1a93bbd8da95071f907a8166eaffbe19eb3e6bef44cfe18685e9c0e60f7a3d5c8
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	regsvr32.exe
4520	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4520	908	regsvr32.exe	83
PID 908 wrote to memory of 4520	908	regsvr32.exe	83
PID 908 wrote to memory of 4520	908	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4056edf1bdf53c9bc92b51eb973c243437fb2ab478b0d3e4641730a39cb3faa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e4056edf1bdf53c9bc92b51eb973c243437fb2ab478b0d3e4641730a39cb3faa.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4520-134-0x0000000002240000-0x0000000002268000-memory.dmp

Download