emotet | c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7 | Triage™

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7.dll
Size 684KB
Sample220323-phz81adhd2
SHA256 c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7
MD5 5d58d59f71b41ac66a5a308a8424264f
SHA1 311bb865323017a4a42e27f8bc71cae705c07c01
SHA512 b9369ee26a75c8099725b941ebb8ebb9c7e144999544ddcc9e2a1ab6f0d357ea8c3161b18b0b1043cc16bc70d999a44a7135e2be606bd4eaef570cb6011fc92f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	regsvr32.exe
3772	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 3772	696	regsvr32.exe	83
PID 696 wrote to memory of 3772	696	regsvr32.exe	83
PID 696 wrote to memory of 3772	696	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3772-135-0x0000000002410000-0x0000000002437000-memory.dmp

Download