emotet | 2eaf79883fcd5b50dff216dce52d642bb307aab78afd62f59ac8b548d51c4935 | Triage™

Analysis

max time kernel
132s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
28/03/2022, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2612974157a9f14de26d49f00fbefe41.dll
Size 680KB
Sample220328-v645racfe9
SHA256 2eaf79883fcd5b50dff216dce52d642bb307aab78afd62f59ac8b548d51c4935
MD5 2612974157a9f14de26d49f00fbefe41
SHA1 f07ca6ca5bdf3649b9438f0ce985d62779715153
SHA512 363b539105ec70d02e059a9b4c7d8f8a436c40f495c898f3fdead64cb61347999e207c24292148287e4f75670eca2c0ca2085126ad825755d4c7207dd21435ef
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	regsvr32.exe
4500	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 4500	1848	regsvr32.exe	82
PID 1848 wrote to memory of 4500	1848	regsvr32.exe	82
PID 1848 wrote to memory of 4500	1848	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2612974157a9f14de26d49f00fbefe41.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2612974157a9f14de26d49f00fbefe41.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4500-135-0x0000000002140000-0x0000000002164000-memory.dmp

Download