emotet | f8b65da8af31497553d9077265a9d9a3655255f2c44144702594fd9ad3b0bd53 | Triage

Analysis

max time kernel
52s
max time network
139s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 14:59

Sharing

Report Analysis Logs

General

Target

f8b65da8af31497553d9077265a9d9a3655255f2c44144702594fd9ad3b0bd53.dll
Size

532KB
MD5

11bd119e95aa9e321fdf6fca5e1d8e90
SHA1

5d0b4588444ee4a6be69cd30fd3cad5802edd121
SHA256

f8b65da8af31497553d9077265a9d9a3655255f2c44144702594fd9ad3b0bd53
SHA512

3fe82f9aa8bc2dc7b3c933d6f20f84ea09e2f92a0f3b9acd6dd1174e63dbd2b1ed7f23d1cfabd5abce869e316809a8eb4760a0309a964a580c6b13387f3db97a

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1392 regsvr32.exe
1392 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

3932 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3932 wrote to memory of 1392	3932	regsvr32.exe	regsvr32.exe
PID 3932 wrote to memory of 1392	3932	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f8b65da8af31497553d9077265a9d9a3655255f2c44144702594fd9ad3b0bd53.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3932

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MMdAaTlE\soAXdCdZkXHxq.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-121-0x0000000000000000-mapping.dmp

Download
memory/3932-116-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download