emotet | 7b73e7148f778de28404e855d144288c3f59fa55138b2c44e342ceff77dd889b | Triage™

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
24/03/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f11ac863a2b13a3513b180eec7e0d5f.dll
Size 880KB
Sample220324-jsrrqaafhp
SHA256 7b73e7148f778de28404e855d144288c3f59fa55138b2c44e342ceff77dd889b
MD5 1f11ac863a2b13a3513b180eec7e0d5f
SHA1 6858248e3f36b37829531f2c5e2066aa8dab3873
SHA512 71d88d76ec7b2161de0dcc89387699d26233be7fac8388246923095d8e5a32b1610788d493530f64ea03fcba31d0e4b1df9eff3a28d1b78bced48650f45789ee
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	regsvr32.exe
748	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 748	3784	regsvr32.exe	83
PID 3784 wrote to memory of 748	3784	regsvr32.exe	83
PID 3784 wrote to memory of 748	3784	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f11ac863a2b13a3513b180eec7e0d5f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1f11ac863a2b13a3513b180eec7e0d5f.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-135-0x0000000000C00000-0x0000000000C24000-memory.dmp

Download