emotet | 64bbd34fd6fb5717238c8e9142cf6d6cc42654d4e3ef316fbea5952c7747dbc0 | Triage™

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
29/03/2022, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9f0b98b4634763ac3cdf86f566da1e4.dll
Size 576KB
Sample220329-mbx4ysdba5
SHA256 64bbd34fd6fb5717238c8e9142cf6d6cc42654d4e3ef316fbea5952c7747dbc0
MD5 d9f0b98b4634763ac3cdf86f566da1e4
SHA1 afac9b6d8cfca1f46c0a1e69aa515758cdaf2241
SHA512 fe170694717bf70eea1758edbc2a46bccb164e87294ab8a89c8deebfc13071118605d579d0784ff121103cd3a55d85ec342082cf3214ab07d47c79f39cffd8af
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	regsvr32.exe
1664	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1664	1496	regsvr32.exe	82
PID 1496 wrote to memory of 1664	1496	regsvr32.exe	82
PID 1496 wrote to memory of 1664	1496	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9f0b98b4634763ac3cdf86f566da1e4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d9f0b98b4634763ac3cdf86f566da1e4.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-131-0x0000000001540000-0x0000000001564000-memory.dmp

Download