emotet | 841005bf947f2d920c2a36c26368698160d4feb4469505549d65d61ebde9a9ae | Triage

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-05-2022 14:34

Sharing

Report Analysis Logs

General

Target

edf2d1c7e938ef6fb6d9188b7005db35.dll
Size

532KB
MD5

edf2d1c7e938ef6fb6d9188b7005db35
SHA1

5c76c7a00e36c6b5ba21a5a704a46596d51f804f
SHA256

841005bf947f2d920c2a36c26368698160d4feb4469505549d65d61ebde9a9ae
SHA512

d6d07908b3983431eff742118f37dcbe869044887958df6e0492c9f3c17f9247f285e23f150001bcf4ce70d91bd5cc174428ba8dd5d52410f4ed95bb6fd7333d

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1020 regsvr32.exe
1020 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3420 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3420 wrote to memory of 1020	3420	regsvr32.exe	regsvr32.exe
PID 3420 wrote to memory of 1020	3420	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\edf2d1c7e938ef6fb6d9188b7005db35.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QDzSqSh\BGSaQCVv.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-133-0x0000000000000000-mapping.dmp

Download
memory/3420-130-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download