emotet | 21ddb01031734032451d24c638a1338de4774871a7d638fb88d1b99b5dc5bc9d | Triage

Analysis

max time kernel
52s
max time network
142s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:01

Sharing

Report Analysis Logs

General

Target

21ddb01031734032451d24c638a1338de4774871a7d638fb88d1b99b5dc5bc9d.dll
Size

532KB
MD5

7b40147fda0a73358713fdf5d3b1f67e
SHA1

1dda40ab4c130358aa7427f104f2e2fb6f9c5ccb
SHA256

21ddb01031734032451d24c638a1338de4774871a7d638fb88d1b99b5dc5bc9d
SHA512

b5db7964478e58c1edd19c63ca3e61eed24af218e39237e50ad1d33397c970f128afa3541a78f3104d1bec8faea4991e6a4926984acb85a5ccf9f2895234d4a8

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1536 regsvr32.exe
1536 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3692 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3692 wrote to memory of 1536	3692	regsvr32.exe	regsvr32.exe
PID 3692 wrote to memory of 1536	3692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21ddb01031734032451d24c638a1338de4774871a7d638fb88d1b99b5dc5bc9d.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HvHkRtcE\PqZzkEKB.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-121-0x0000000000000000-mapping.dmp

Download
memory/3692-116-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download