emotet | ff68bd032b6dccf75f96a3e5ee8b557bdad401eb5faf4b32fb35eddbf04ee334 | Triage™

Analysis

max time kernel
143s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff68bd032b6dccf75f96a3e5ee8b557bdad401eb5faf4b32fb35eddbf04ee334.dll
Size 668KB
Sample220323-lfhz6abfe7
SHA256 ff68bd032b6dccf75f96a3e5ee8b557bdad401eb5faf4b32fb35eddbf04ee334
MD5 f16251ed2fa22192707ec68e2ea59c75
SHA1 023a4e5c5a83deb23670ae96de92a304960ed258
SHA512 42a0d8ebab7bf977bcfd7b4eb3e4616e0774c14e43ec8b448c84d76fc0532a1ff83a266533e217813e8732b73583db77e721355613b2f4feea1aa39c54dc1f1b
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	regsvr32.exe
1832	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1832	2396	regsvr32.exe	83
PID 2396 wrote to memory of 1832	2396	regsvr32.exe	83
PID 2396 wrote to memory of 1832	2396	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff68bd032b6dccf75f96a3e5ee8b557bdad401eb5faf4b32fb35eddbf04ee334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ff68bd032b6dccf75f96a3e5ee8b557bdad401eb5faf4b32fb35eddbf04ee334.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-135-0x00000000024E0000-0x0000000002507000-memory.dmp

Download