emotet | 0e86c23ba76da871b23a4e5fde0aa3d73f029f3cf3b55e487f6f22234d0d09ae | Triage™

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
25/03/2022, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hWrB3WDoDZG2h3AUq4cpWIQivUOEBpPELrn.dll
Size 640KB
Sample220325-te38psefcr
SHA256 0e86c23ba76da871b23a4e5fde0aa3d73f029f3cf3b55e487f6f22234d0d09ae
MD5 9ccf0669bceece9f88c3586a2c727f2b
SHA1 1accc3d9500cb49a0059da769229e844a193fce0
SHA512 73024f10680b18849758b34a56d9cd14ce9f331982eff1671598317cb67aa045224671fee1259c0f1e69a54ed1e67f2f26ccf1b2aae145f0dbac03e73af9c20a
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
312	regsvr32.exe
312	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 312	784	regsvr32.exe	78
PID 784 wrote to memory of 312	784	regsvr32.exe	78
PID 784 wrote to memory of 312	784	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\hWrB3WDoDZG2h3AUq4cpWIQivUOEBpPELrn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\hWrB3WDoDZG2h3AUq4cpWIQivUOEBpPELrn.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/312-132-0x0000000002C30000-0x0000000002C54000-memory.dmp

Download