emotet | 858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e | Triage

Analysis

max time kernel
54s
max time network
140s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:49

Sharing

Report Analysis Logs

General

Target

858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e.dll
Size

532KB
MD5

d230f542c29f864bf2ed2bbf9fc78193
SHA1

da5e86d084c327e67820be1b93320cbd25e07d40
SHA256

858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e
SHA512

e6d2f91a573e1273c4a69d0d35acda3d564d46cda874d338db25d393d97a745bcef6e7e94f9dde71f82fdf533a888a6dc3b65ec82c1b8288765cd572c331e08b

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2064 regsvr32.exe
2064 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3696 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3696 wrote to memory of 2064	3696	regsvr32.exe	regsvr32.exe
PID 3696 wrote to memory of 2064	3696	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\858cdaba305db3cc97dca8b69417b52c6220cd776b880a245c773ba4c4a2a08e.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3696

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JtSYnqWoFBQXxMRf\OpHqCS.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-124-0x0000000000000000-mapping.dmp

Download
memory/3696-119-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download