emotet | 4bcab3c23b70c9b8fa12d11766eb07e374f30f2f06c0f8faeaa259ff831dee59 | Triage™

Analysis

max time kernel
146s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4bcab3c23b70c9b8fa12d11766eb07e374f30f2f06c0f8faeaa259ff831dee59.dll
Size 604KB
Sample220322-qrcpqsffc6
SHA256 4bcab3c23b70c9b8fa12d11766eb07e374f30f2f06c0f8faeaa259ff831dee59
MD5 05c8a0dc22ec55de6de886818a72d8b8
SHA1 37f36302a57aa8cb6a94f234c8d02d07596a3fb2
SHA512 554ffe73fc1970c52c44aef2223932785c93f599d1902937b95c36c298c72e83aeb1115805f6e827c10199aaa7d8f45b09bc3d77fd38ef536c6221198836606d
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3568	regsvr32.exe
3568	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3568	2692	regsvr32.exe	80
PID 2692 wrote to memory of 3568	2692	regsvr32.exe	80
PID 2692 wrote to memory of 3568	2692	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4bcab3c23b70c9b8fa12d11766eb07e374f30f2f06c0f8faeaa259ff831dee59.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4bcab3c23b70c9b8fa12d11766eb07e374f30f2f06c0f8faeaa259ff831dee59.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3568-130-0x0000000002C40000-0x0000000002C67000-memory.dmp

Download