emotet | 3d7e9b9f37e9715ce1b8eda633a278dd0f4aeab88563bb1e6f439b8a5140eb71 | Triage

Analysis

max time kernel
51s
max time network
138s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:04

Sharing

Report Analysis Logs

General

Target

3d7e9b9f37e9715ce1b8eda633a278dd0f4aeab88563bb1e6f439b8a5140eb71.dll
Size

532KB
MD5

803dbd3c7c68f4606a8185666abaf455
SHA1

19645a5b9c5ed29932a573afe0f8d9e6d542122d
SHA256

3d7e9b9f37e9715ce1b8eda633a278dd0f4aeab88563bb1e6f439b8a5140eb71
SHA512

0ad70f41eedf68c1169c2185f253aba50334ac206a65251421dfc283e564548b336dca568214ead94b2cf7d09540d3e4ef22b8ea0a0ea146f26bccf4fea135a4

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1584 regsvr32.exe
1584 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3584 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3584 wrote to memory of 1584	3584	regsvr32.exe	regsvr32.exe
PID 3584 wrote to memory of 1584	3584	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d7e9b9f37e9715ce1b8eda633a278dd0f4aeab88563bb1e6f439b8a5140eb71.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GeXlmrDB\EGfq.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-123-0x0000000000000000-mapping.dmp

Download
memory/3584-118-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download