emotet | 9e752beac064c969e8b5237bad53c3cddcb13ab7bf9e039efeb76582af57c8da | Triage

Analysis

max time kernel
52s
max time network
136s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:28

Sharing

Report Analysis Logs

General

Target

9e752beac064c969e8b5237bad53c3cddcb13ab7bf9e039efeb76582af57c8da.dll
Size

538KB
MD5

a8cb39a795537bca0c0ef782e41be036
SHA1

82b5ffe3d57d1e3032bc6a4718fd9b0b4090ac59
SHA256

9e752beac064c969e8b5237bad53c3cddcb13ab7bf9e039efeb76582af57c8da
SHA512

9faf5f8f9cfb06004d990ef520baaf972908eca8776c1d93473f94f1c32abcd8153f1ce8fcecc5c920d27b90817e159e55baff0f626b5a00f8d588ddb3d50767

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3144 regsvr32.exe
3144 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2428 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2428 wrote to memory of 3144	2428	regsvr32.exe	regsvr32.exe
PID 2428 wrote to memory of 3144	2428	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e752beac064c969e8b5237bad53c3cddcb13ab7bf9e039efeb76582af57c8da.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SLATDpUGcIDxd\JjKKlppYlXYNKM.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-116-0x0000000180000000-0x0000000180032000-memory.dmp

Filesize
200KB

Download
memory/3144-121-0x0000000000000000-mapping.dmp

Download