emotet | d5d04787da55c21f9d723505e23a70a76b8a76a8c19e1596ce66d9e5a1f798a3 | Triage™

Analysis

max time kernel
109s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
22/03/2022, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5d04787da55c21f9d723505e23a70a76b8a76a8c19e1596ce66d9e5a1f798a3.dll
Size 780KB
Sample220322-rtms6acdbm
SHA256 d5d04787da55c21f9d723505e23a70a76b8a76a8c19e1596ce66d9e5a1f798a3
MD5 be7ecb4d863fc53d75ebadec1a1b188d
SHA1 51e2c343ab633e89c418d4de648598062aa9b5e0
SHA512 cf48f88a6edf36630cb392f10ead36eddc5b726e8473bb41cfb9c5b6a14aabf72f48d07524c7b38def6b5296b6ff0ba57c8e9b9558efe76a682ded9a792010cd
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2104	regsvr32.exe
2104	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2104	4704	regsvr32.exe	82
PID 4704 wrote to memory of 2104	4704	regsvr32.exe	82
PID 4704 wrote to memory of 2104	4704	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d5d04787da55c21f9d723505e23a70a76b8a76a8c19e1596ce66d9e5a1f798a3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d5d04787da55c21f9d723505e23a70a76b8a76a8c19e1596ce66d9e5a1f798a3.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-134-0x0000000000EC0000-0x0000000000F0C000-memory.dmp

Download