emotet | f8ef9a8eb9d783ee026fd8c2de9e508e6a14b5b0d19bf7e5ef6e05e00ef970aa | Triage™

Analysis

max time kernel
151s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8ef9a8eb9d783ee026fd8c2de9e508e6a14b5b0d19bf7e5ef6e05e00ef970aa.dll
Size 668KB
Sample220323-letp9sbfd4
SHA256 f8ef9a8eb9d783ee026fd8c2de9e508e6a14b5b0d19bf7e5ef6e05e00ef970aa
MD5 3bdc7592d1fff9c2a39048237aff7928
SHA1 fba0bc14ddf846eb526f2e1919e5054b6e18c4d4
SHA512 f2ebbd0fa4c4f1da6a638545e982cb42a95d52988b11d97bb270b8600764d4c3c01f1fdcc2423c46cd4da49efab953d6d1b22f8c3fe1b7d5a144047f1d4db839
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	regsvr32.exe
456	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 456	3444	regsvr32.exe	84
PID 3444 wrote to memory of 456	3444	regsvr32.exe	84
PID 3444 wrote to memory of 456	3444	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f8ef9a8eb9d783ee026fd8c2de9e508e6a14b5b0d19bf7e5ef6e05e00ef970aa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f8ef9a8eb9d783ee026fd8c2de9e508e6a14b5b0d19bf7e5ef6e05e00ef970aa.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-135-0x0000000002CC0000-0x0000000002CE7000-memory.dmp

Download