emotet | d9c1495eb299290eff505de16198744503dcf93359f6c23b81b7efb95e4bb3c1 | Triage™

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9c1495eb299290eff505de16198744503dcf93359f6c23b81b7efb95e4bb3c1.dll
Size 780KB
Sample220322-rtms6acdbn
SHA256 d9c1495eb299290eff505de16198744503dcf93359f6c23b81b7efb95e4bb3c1
MD5 8abec13f023902ebbb957898bda65a1c
SHA1 a559b7e86965c6456b05fe8ad3c2cc9ea6b28bcb
SHA512 e24b704e2e9a28c3a34e73da4954f3a3c1fdd144b9aaaddd69aa3e96e63e5fdd12ddc2c1b649f504804def8018b00b8c7d2e919c97d82685781aaad91612e9ac
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	regsvr32.exe
2816	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2816	4228	regsvr32.exe	80
PID 4228 wrote to memory of 2816	4228	regsvr32.exe	80
PID 4228 wrote to memory of 2816	4228	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9c1495eb299290eff505de16198744503dcf93359f6c23b81b7efb95e4bb3c1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d9c1495eb299290eff505de16198744503dcf93359f6c23b81b7efb95e4bb3c1.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-130-0x0000000002C00000-0x0000000002C4C000-memory.dmp

Download