emotet | 1055ec135d5746738d9af7e685d3265ac4c370d5c9023449f8847b2d1a93a572 | Triage

Analysis

max time kernel
128s
max time network
168s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 13:56

Sharing

Report Analysis Logs

General

Target

1055ec135d5746738d9af7e685d3265ac4c370d5c9023449f8847b2d1a93a572.dll
Size

532KB
MD5

36f312dbc85f99ddc19c7dca89f14ef3
SHA1

a63e36f66c55704cfe51082cd0aa635538ceaf51
SHA256

1055ec135d5746738d9af7e685d3265ac4c370d5c9023449f8847b2d1a93a572
SHA512

575d8df33b6add4c39e52ac85bf187f50d3935dcea6e5dfc06908fa33a6672211433b0325ff0f295ac77e81933aac3008990c392b0c64008c9ebc216e95630ba

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4660 regsvr32.exe
4660 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2904 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2904 wrote to memory of 4660	2904	regsvr32.exe	regsvr32.exe
PID 2904 wrote to memory of 4660	2904	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1055ec135d5746738d9af7e685d3265ac4c370d5c9023449f8847b2d1a93a572.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GHMDLWgQDzXBzZv\rZSC.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2904-114-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/4660-119-0x0000000000000000-mapping.dmp

Download