emotet | 90b9b520a8a83ba27bf9fe7d6b666c5cbfd3b67a6c362988f4a78a89d54faea8 | Triage™

Analysis

max time kernel
162s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sQuUUDbggx.WTM.dll
Size 667KB
Sample220512-wj5nfaabgm
SHA256 90b9b520a8a83ba27bf9fe7d6b666c5cbfd3b67a6c362988f4a78a89d54faea8
MD5 8dd91e4c98613caf4034f6135c42409b
SHA1 b62b3d24ca220e2d03b71cecd20ca446a178e857
SHA512 ce9cc554c62745f0d0361ea7ef6f0206a82d5b5fe85bff67fd6637e2bf3e7895a7e60249c12fd35f1ad5bca1297df6767a012c76a2e0722be8011608fff9d42a
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	regsvr32.exe
4352	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
548	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4352	548	regsvr32.exe	97
PID 548 wrote to memory of 4352	548	regsvr32.exe	97

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sQuUUDbggx.WTM.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FrLYdZrrRmOSmJHL\TiNVxWHkJEZTCNd.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download