emotet | 16076d2142fe2a8a3635a983574caca8eb26ec99c1fb300b559f6b37b57fe21a | Triage

Analysis

max time kernel
72s
max time network
140s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:49

Sharing

Report Analysis Logs

General

Target

16076d2142fe2a8a3635a983574caca8eb26ec99c1fb300b559f6b37b57fe21a.dll
Size

538KB
MD5

53cb01d4a060d9c4e5d0713413f85191
SHA1

715ff36035947b9f30dc42f57147e36893da8580
SHA256

16076d2142fe2a8a3635a983574caca8eb26ec99c1fb300b559f6b37b57fe21a
SHA512

66b0aeb4de37ab3696efa0634a430a311939a6cb4d823fcfcfbb98d9ba20422bbfc32c0ec15628338810872d5523b26f840ffbbeb417e838b189bbf63fc7bcef

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1584 regsvr32.exe
1584 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3584 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3584 wrote to memory of 1584	3584	regsvr32.exe	regsvr32.exe
PID 3584 wrote to memory of 1584	3584	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16076d2142fe2a8a3635a983574caca8eb26ec99c1fb300b559f6b37b57fe21a.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DKBYT\uKgviBCRir.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-123-0x0000000000000000-mapping.dmp

Download
memory/3584-118-0x0000000180000000-0x0000000180032000-memory.dmp

Filesize
200KB

Download