emotet | a72eb86e4f71e920c9fa8eba2308220f17e1ba9b228b2cff535accff816ce8b3 | Triage™

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff7c0b055713ef209218ff4b3f244332.dll
Size 764KB
Sample220512-jw4wfsecdk
SHA256 a72eb86e4f71e920c9fa8eba2308220f17e1ba9b228b2cff535accff816ce8b3
MD5 ff7c0b055713ef209218ff4b3f244332
SHA1 a420c39ff15e16b63fede8b435b521d0dd9cf20a
SHA512 91be57742210249a2a11a8799c1a51c014919b8264eec67ab57d0b8e4800ff51dac54227aff1bdf8c2a6d5c9d1c00acdb97651d8f2fe0cd01451ef2e380ce72c
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4996	regsvr32.exe
4996	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1864	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4996	1864	regsvr32.exe	80
PID 1864 wrote to memory of 4996	1864	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff7c0b055713ef209218ff4b3f244332.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FhtBaFIAgxkcpqpY\UHqDJweMQc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-130-0x0000000001380000-0x00000000013B0000-memory.dmp

Download