emotet | db9b10dc3af4e16488e196dd1eb64d6ce4df1fc38b778e6f7dfebf3cdead1151 | Triage™

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db9b10dc3af4e16488e196dd1eb64d6ce4df1fc38b778e6f7dfebf3cdead1151.dll
Size 780KB
Sample220322-rvda4sgad4
SHA256 db9b10dc3af4e16488e196dd1eb64d6ce4df1fc38b778e6f7dfebf3cdead1151
MD5 61f5def74d509cfd691cb6732134ef42
SHA1 e0daf7fe3f1aa6bceb41d0f4bc3afdd9c046fc52
SHA512 339f131fceee4a30f64b10250544c322a649b513fb56fc66fab690c1b78daea445bf3064b5a0efc4f60a1f76338cbf9261ec173fe74e161c921c0a1b28d27419
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	regsvr32.exe
2100	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2100	2008	regsvr32.exe	78
PID 2008 wrote to memory of 2100	2008	regsvr32.exe	78
PID 2008 wrote to memory of 2100	2008	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\db9b10dc3af4e16488e196dd1eb64d6ce4df1fc38b778e6f7dfebf3cdead1151.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\db9b10dc3af4e16488e196dd1eb64d6ce4df1fc38b778e6f7dfebf3cdead1151.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-130-0x00000000027F0000-0x000000000283C000-memory.dmp

Download