emotet | 86e4bf65c097d97d585374f6fc341eadd4676a2b7061c54d8576b9839b2e3ac0 | Triage™

Analysis

max time kernel
113s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86e4bf65c097d97d585374f6fc341eadd4676a2b7061c54d8576b9839b2e3ac0.dll
Size 688KB
Sample220323-kner2aagg7
SHA256 86e4bf65c097d97d585374f6fc341eadd4676a2b7061c54d8576b9839b2e3ac0
MD5 2f01f10592795946d77c3ff62c502c51
SHA1 abd691548074614304527775881880934b48c96c
SHA512 d6d378c8690e889401c167a0a51f244a6f092b65d983dbc4851aa4e2edde289e5e1d02baeba605466025b051b09a5200252d61de1de32037f24ba4b5f25b7955
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	regsvr32.exe
2404	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2404	1936	regsvr32.exe	83
PID 1936 wrote to memory of 2404	1936	regsvr32.exe	83
PID 1936 wrote to memory of 2404	1936	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\86e4bf65c097d97d585374f6fc341eadd4676a2b7061c54d8576b9839b2e3ac0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\86e4bf65c097d97d585374f6fc341eadd4676a2b7061c54d8576b9839b2e3ac0.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-135-0x0000000002F50000-0x0000000002F78000-memory.dmp

Download