emotet | 268aa1e2fe151de8387ce4b4e052fd974612988d0843d6026529e0aa5080c0a4 | Triage™

Analysis

max time kernel
116s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
22/03/2022, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
268aa1e2fe151de8387ce4b4e052fd974612988d0843d6026529e0aa5080c0a4.dll
Size 780KB
Sample220322-rh1wmsfhd3
SHA256 268aa1e2fe151de8387ce4b4e052fd974612988d0843d6026529e0aa5080c0a4
MD5 48ee1ccea099521ef8ab600996d431de
SHA1 cc314097857c2a05f723985761a5affd253a0770
SHA512 ce767e84e56557504aaffee6b053640fff410ac6378c3db2371a9dd93a36bf2da1b914e2a8714b84f6f59c9702d040e951880374346ed1a06bd1b49cf6b647d4
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5112	regsvr32.exe
5112	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 5112	3088	regsvr32.exe	83
PID 3088 wrote to memory of 5112	3088	regsvr32.exe	83
PID 3088 wrote to memory of 5112	3088	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\268aa1e2fe151de8387ce4b4e052fd974612988d0843d6026529e0aa5080c0a4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\268aa1e2fe151de8387ce4b4e052fd974612988d0843d6026529e0aa5080c0a4.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5112-134-0x0000000002680000-0x00000000026CC000-memory.dmp

Download