emotet | f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5 | Triage™

Analysis

max time kernel
115s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5.dll
Size 668KB
Sample220323-lecfzsbfc6
SHA256 f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5
MD5 9abdf30b7b8560e637c422613b4ae918
SHA1 ff14a45fd2bbfecfc6a7b1eac0e54b5261d53658
SHA512 68af1d8c5e1af5cd8941785d390d6e45b0806ea42e06bb083d7f41d3c8d317fe7a8beb8d44911a4edeed6f3f2eb99a799d6b3cc979c3b8eb83d094c6cc676f7e
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	regsvr32.exe
1532	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1532	3728	regsvr32.exe	82
PID 3728 wrote to memory of 1532	3728	regsvr32.exe	82
PID 3728 wrote to memory of 1532	3728	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-135-0x0000000002840000-0x0000000002867000-memory.dmp

Download