emotet | 1dbd851574939d80a14410ffbd3c271a6ebebabd8d5eae51f3d0b5d827f13d3f | Triage™

Analysis

max time kernel
73s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22/03/2022, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1dbd851574939d80a14410ffbd3c271a6ebebabd8d5eae51f3d0b5d827f13d3f.dll
Size 504KB
Sample220322-rx5hdagag7
SHA256 1dbd851574939d80a14410ffbd3c271a6ebebabd8d5eae51f3d0b5d827f13d3f
MD5 815d752788fe2533486caafe62347511
SHA1 ec35ef993b27e4077747e32215d68f5563779d6c
SHA512 ca56d0b2b6ac1eaf31d3b8e07613561de8aaa39a6aed9ccb643bd1d9ed0be6e8ee3bb212541cc6133e510380de80e70335d25e03876e5c093f93fd943e0b44e9
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	regsvr32.exe
2748	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2748	2740	regsvr32.exe	80
PID 2740 wrote to memory of 2748	2740	regsvr32.exe	80
PID 2740 wrote to memory of 2748	2740	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1dbd851574939d80a14410ffbd3c271a6ebebabd8d5eae51f3d0b5d827f13d3f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1dbd851574939d80a14410ffbd3c271a6ebebabd8d5eae51f3d0b5d827f13d3f.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-130-0x0000000002B30000-0x0000000002B58000-memory.dmp

Download