emotet | 145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc | Triage™

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc.dll
Size 684KB
Sample220323-pbmpbsdfe9
SHA256 145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc
MD5 b92921ed45cd4675ba751b58a10fd42f
SHA1 bf3afc33182519e4a90446d7d7109d92c1791493
SHA512 127ae21af15242ce0e7b7a8347b7dba0ae974572c88272174b36af89e52f61be08c77dd4c102b966a9e8e2a3cc9dd2a9e7828f45f7757f04f7226e47895d17ed
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	regsvr32.exe
4336	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4336	448	regsvr32.exe	83
PID 448 wrote to memory of 4336	448	regsvr32.exe	83
PID 448 wrote to memory of 4336	448	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-135-0x00000000021D0000-0x00000000021F7000-memory.dmp

Download