emotet | 6d3d61fa2f6254dffb8fd40384cd0396ee5e9af84d96b2ee45711270d2bb670c | Triage™

Analysis

max time kernel
77s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11/05/2022, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet_epoch4.dll
Size 501KB
Sample220511-qncwbsbbhl
SHA256 6d3d61fa2f6254dffb8fd40384cd0396ee5e9af84d96b2ee45711270d2bb670c
MD5 02ac07df0fa4e54a7156be35f408b939
SHA1 2bc58d529e9d6251b28e1ca0b58a44916d54c140
SHA512 2a6e5b045c4c7d307644c5fe2743890c741f7d40da7199965dbbdc8c7e254aa69971c6c16ad95080570170988fcb3d7b01a7ee5884a04178dc1f260f17bb7c98
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	regsvr32.exe
1896	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4836	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1896	4836	regsvr32.exe	83
PID 4836 wrote to memory of 1896	4836	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_epoch4.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZYGFqVFx\aYTVoiKgfNwy.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4836-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download