emotet | 2e7a2dcb0cc817ca82fe3104b84c664843bfcb86e787685893b0fccb3e3eed28 | Triage™

Analysis

max time kernel
105s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
13/05/2022, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0597ef63154d8ecb2367929542ac98f2.dll
Size 586KB
Sample220513-jldaragcek
SHA256 2e7a2dcb0cc817ca82fe3104b84c664843bfcb86e787685893b0fccb3e3eed28
MD5 0597ef63154d8ecb2367929542ac98f2
SHA1 a17c22e1024a2a166d5f47d10d510d419064fd0e
SHA512 da791d981e5dae801a76bf47e9db1489881558d93cf39b4d7f83c04146e50ac3819a64db598bc2deb5952eaa20535b0b027ca258e963fec712954325bb17aee2
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5104	regsvr32.exe
5104	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2260	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 5104	2260	regsvr32.exe	81
PID 2260 wrote to memory of 5104	2260	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0597ef63154d8ecb2367929542ac98f2.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AatPPgQBL\lKIzhyLcTo.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download