emotet | 6f589e1d533cecf8a0a098a349c072dc2f6021a77bbca11e52e022a53f8aed88 | Triage™

Analysis

max time kernel
136s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
25/03/2022, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6065d86eaf2b82bff0a3a1bb8dcdfa98.dll
Size 640KB
Sample220325-vptyfsaea2
SHA256 6f589e1d533cecf8a0a098a349c072dc2f6021a77bbca11e52e022a53f8aed88
MD5 6065d86eaf2b82bff0a3a1bb8dcdfa98
SHA1 2f8d5e13ef702b9f4149576a1ac256546371db87
SHA512 ffe6ba64ac9127f41bae0cc49e101e8adbd568bffaa8488a1db3a51e2eec427ba4d3f499e5cf1f46262429a3cf8a54e6890007e769a797524044f5d55bfa709f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4564	regsvr32.exe
4564	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4564	2684	regsvr32.exe	83
PID 2684 wrote to memory of 4564	2684	regsvr32.exe	83
PID 2684 wrote to memory of 4564	2684	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6065d86eaf2b82bff0a3a1bb8dcdfa98.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6065d86eaf2b82bff0a3a1bb8dcdfa98.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-135-0x0000000002980000-0x00000000029A4000-memory.dmp

Download