emotet | dce7d43c9673ff506c61cb78ff8ad20c36b385ecb5ade2ca40a83a8812cd8870 | Triage™

Analysis

max time kernel
129s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
28/03/2022, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b94a2d304e8d4f1598a1333ad48cec6.dll
Size 652KB
Sample220328-a73yvsfbd3
SHA256 dce7d43c9673ff506c61cb78ff8ad20c36b385ecb5ade2ca40a83a8812cd8870
MD5 0b94a2d304e8d4f1598a1333ad48cec6
SHA1 d619aa68dd455c5e839f7bf4cc491d16877a9a33
SHA512 fcd65f7ef96b565247ef33d60e5823381bdd76d82250a436548a26eca9dc6218c8a28de21565b3f999aa19b4768b03fece682b6b2ec323f700f653158159dc64
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	regsvr32.exe
2424	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2424	2236	regsvr32.exe	78
PID 2236 wrote to memory of 2424	2236	regsvr32.exe	78
PID 2236 wrote to memory of 2424	2236	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0b94a2d304e8d4f1598a1333ad48cec6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0b94a2d304e8d4f1598a1333ad48cec6.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-131-0x0000000001510000-0x0000000001534000-memory.dmp

Download