emotet | 574eb0b0a52a931c109dfa414edfede40889eea68f8c093a141b412788f71e8e | Triage™

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
23/03/2022, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
574eb0b0a52a931c109dfa414edfede40889eea68f8c093a141b412788f71e8e.dll
Size 668KB
Sample220323-k33seaffcq
SHA256 574eb0b0a52a931c109dfa414edfede40889eea68f8c093a141b412788f71e8e
MD5 0a6985ccac85c26d4fefe37046e84d81
SHA1 e69bfe68f24eda9544fd36cd3b944a64501751c5
SHA512 4ae76d83cc315a7e392885bc97b923490898fa33bd8cb62ed83ab4537e895755eb658451c478aa92542bab7e26ea9d97564521058f0d95fc4dcf6bfb1549a0c8
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3468	regsvr32.exe
3468	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3468	1344	regsvr32.exe	80
PID 1344 wrote to memory of 3468	1344	regsvr32.exe	80
PID 1344 wrote to memory of 3468	1344	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\574eb0b0a52a931c109dfa414edfede40889eea68f8c093a141b412788f71e8e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\574eb0b0a52a931c109dfa414edfede40889eea68f8c093a141b412788f71e8e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3468-134-0x0000000003150000-0x0000000003177000-memory.dmp

Download