emotet | b4cd7c63c7e2bfcd7683e0ed296c33ffe4e58b00a639839fcbe743f357223e94 | Triage

Analysis

max time kernel
54s
max time network
142s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:10

Sharing

Report Analysis Logs

General

Target

b4cd7c63c7e2bfcd7683e0ed296c33ffe4e58b00a639839fcbe743f357223e94.dll
Size

532KB
MD5

395f261f4c3c538fb68916261b53ea5e
SHA1

66e02341ed7f8d938a96203a8d89e7705fdbb275
SHA256

b4cd7c63c7e2bfcd7683e0ed296c33ffe4e58b00a639839fcbe743f357223e94
SHA512

39e4e3889b33c4a193dabe762ea7bddf51380e5b19f73b5804bbbb0edf655c50bcc88a540b5f476f5b6b96ddf5557f4f73c75104dcf618ea5a3c7c0a13352f7a

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

2180 regsvr32.exe
2180 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1784 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1784 wrote to memory of 2180	1784	regsvr32.exe	regsvr32.exe
PID 1784 wrote to memory of 2180	1784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b4cd7c63c7e2bfcd7683e0ed296c33ffe4e58b00a639839fcbe743f357223e94.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BpIwChVjN\hNyDfUmLmxbl.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-114-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/2180-119-0x0000000000000000-mapping.dmp

Download