emotet | d86ce975ffe409e6a17a044559bf48bc5562b5ec44d0dcdcbeecaf37eaa9aca3 | Triage™

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
23/03/2022, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d86ce975ffe409e6a17a044559bf48bc5562b5ec44d0dcdcbeecaf37eaa9aca3.dll
Size 668KB
Sample220323-lb6knabef3
SHA256 d86ce975ffe409e6a17a044559bf48bc5562b5ec44d0dcdcbeecaf37eaa9aca3
MD5 817582af06d403acc258658e013d07a5
SHA1 e17dbd669454eff5236585e448b770e2f6df9698
SHA512 a78a2970077c975458e046b9c5632dc269290c3030ce2d1ad7097be887c3749e43f06c91a1eaafc83804fb01e9c7861353a798619baf150f5cac7a2d1713cc51
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	regsvr32.exe
1460	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1460	1392	regsvr32.exe	80
PID 1392 wrote to memory of 1460	1392	regsvr32.exe	80
PID 1392 wrote to memory of 1460	1392	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d86ce975ffe409e6a17a044559bf48bc5562b5ec44d0dcdcbeecaf37eaa9aca3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d86ce975ffe409e6a17a044559bf48bc5562b5ec44d0dcdcbeecaf37eaa9aca3.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-131-0x0000000002770000-0x0000000002797000-memory.dmp

Download