emotet | acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f | Triage™

Analysis

max time kernel
131s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f.dll
Size 668KB
Sample220323-lack7abeb6
SHA256 acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f
MD5 313fa72b5fe8f4574476bdf6feedaaf3
SHA1 735992b30d9dfdaff8433422fd8df308a0fe4dcc
SHA512 dd5b112315f4625930359b0efc707b9fdb9e5dce136d0de85062044ffd59eada2573096c3c336d7b7ee5a9ecee348c7fb4158e3fe48059040fdec8c7c41a897c
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3092	regsvr32.exe
3092	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3092	2528	regsvr32.exe	83
PID 2528 wrote to memory of 3092	2528	regsvr32.exe	83
PID 2528 wrote to memory of 3092	2528	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3092-135-0x0000000002790000-0x00000000027B7000-memory.dmp

Download