emotet | a4004d738bc28ce82f33eabd28efa7ed7e649909f8aac891a9b2dcdcaba8d3d2 | Triage™

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
13/05/2022, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdaa5bda98bae36fe55025e2b90b5f6c.dll
Size 586KB
Sample220513-klen9adhf3
SHA256 a4004d738bc28ce82f33eabd28efa7ed7e649909f8aac891a9b2dcdcaba8d3d2
MD5 fdaa5bda98bae36fe55025e2b90b5f6c
SHA1 3ee2663f2b921c11b835c1f683b7aa2bb119576b
SHA512 2ed78ea67b2ce7e311f6b2d4107b5ed1f02c5cd848408c00fcd70c2de732167fdf0a163f10d0f8506ffb248cf15c174772b1fb2879578c991f72e26245438c1c
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1172	regsvr32.exe
1172	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4944	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 1172	4944	regsvr32.exe	82
PID 4944 wrote to memory of 1172	4944	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fdaa5bda98bae36fe55025e2b90b5f6c.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RDvgjhMBQsSXoT\HapRWVaXzTwdB.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download