emotet | fd5b508aee953675d975a864057881e0106c2c22142737ea014e2558ced817b0 | Triage

Analysis

max time kernel
53s
max time network
146s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 13:20

Sharing

Report Analysis Logs

General

Target

fd5b508aee953675d975a864057881e0106c2c22142737ea014e2558ced817b0.dll
Size

532KB
MD5

f824fa64abb5b552a02995841aac55ef
SHA1

29dc66440caf1d5cf1ef2c7111899f079c7e3d2c
SHA256

fd5b508aee953675d975a864057881e0106c2c22142737ea014e2558ced817b0
SHA512

dd4e0d7a191399228f25270424e30d86550ccd2b8c87109c6d710a86700ce27cb035684157d676ea228d7358b15cedd3b7ec40bfe18ad4d1006a89dd0faad38e

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3548 regsvr32.exe
3548 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2472 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2472 wrote to memory of 3548	2472	regsvr32.exe	regsvr32.exe
PID 2472 wrote to memory of 3548	2472	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd5b508aee953675d975a864057881e0106c2c22142737ea014e2558ced817b0.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\STFQXMVAV\dzQzFzYk.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-117-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/3548-122-0x0000000000000000-mapping.dmp

Download