emotet | bc1111d1264f6edc2da11f4e204b18801a5f7de4ac014796d84c5f66b52a1e1a | Triage™

Analysis

max time kernel
136s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc1111d1264f6edc2da11f4e204b18801a5f7de4ac014796d84c5f66b52a1e1a.dll
Size 780KB
Sample220322-rnqymacchj
SHA256 bc1111d1264f6edc2da11f4e204b18801a5f7de4ac014796d84c5f66b52a1e1a
MD5 b2faebbc0cf8ad8f89cee8a92af0b418
SHA1 2a4097805c0e563634f6ae96015e0582b9cc6b5f
SHA512 4e0fa2ef43f18a6ca3693b8c76bf55a55cfaf5a2ed26bd932d967dde471acf241c5397f8a81816818bbb9d28a29bf1a876b54a15d01830e8bb780af422f23b50
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
868	regsvr32.exe
868	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 868	572	regsvr32.exe	79
PID 572 wrote to memory of 868	572	regsvr32.exe	79
PID 572 wrote to memory of 868	572	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bc1111d1264f6edc2da11f4e204b18801a5f7de4ac014796d84c5f66b52a1e1a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bc1111d1264f6edc2da11f4e204b18801a5f7de4ac014796d84c5f66b52a1e1a.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-130-0x0000000002E80000-0x0000000002ECC000-memory.dmp

Download