emotet | 0f17cd27e46f5d1e06970031ff91f5f4065d62a764268caa9870537efd07dcbe | Triage™

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f17cd27e46f5d1e06970031ff91f5f4065d62a764268caa9870537efd07dcbe.dll
Size 997KB
Sample220323-j1kndaedeq
SHA256 0f17cd27e46f5d1e06970031ff91f5f4065d62a764268caa9870537efd07dcbe
MD5 44489ae68d49fdbf9057b1b78af2c0ce
SHA1 baac36da2439d10e90b95c8c7a6e0599dc43591e
SHA512 24488ba53b09efb1c131bdfccd3893701edcc429d939a0f34033c185ee307cc9af20da24bdb44445fc02eae24b991ac31769c9043e6856eb4cb6d18b4ddffdd7
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	regsvr32.exe
2532	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2532	2376	regsvr32.exe	83
PID 2376 wrote to memory of 2532	2376	regsvr32.exe	83
PID 2376 wrote to memory of 2532	2376	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f17cd27e46f5d1e06970031ff91f5f4065d62a764268caa9870537efd07dcbe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0f17cd27e46f5d1e06970031ff91f5f4065d62a764268caa9870537efd07dcbe.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-135-0x0000000010000000-0x0000000010028000-memory.dmp

Download