emotet | 88f0a1ebc6f8ef3a64016547f054dae52266d21e3b477af3defdf214ec33bbf3 | Triage

Analysis

max time kernel
52s
max time network
139s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:55

Sharing

Report Analysis Logs

General

Target

88f0a1ebc6f8ef3a64016547f054dae52266d21e3b477af3defdf214ec33bbf3.dll
Size

532KB
MD5

b94deed373708d5bbffc079fee883cf0
SHA1

f016616d89f0f2a08b83ca7abfc23183e5a28cfa
SHA256

88f0a1ebc6f8ef3a64016547f054dae52266d21e3b477af3defdf214ec33bbf3
SHA512

73918abced05cea62d80314b901614c223439038533a4fbe271f21e7db5e1ffbc71c96d23532a6427f403a17fb32d4eb6b83c314fea627a62c3ba82caf3c528a

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1372 regsvr32.exe
1372 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1184 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1184 wrote to memory of 1372	1184	regsvr32.exe	regsvr32.exe
PID 1184 wrote to memory of 1372	1184	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88f0a1ebc6f8ef3a64016547f054dae52266d21e3b477af3defdf214ec33bbf3.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KRKSExJxiwM\wTysHBspvpjoqSc.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-116-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/1372-121-0x0000000000000000-mapping.dmp

Download