emotet | 169aae931dfec389edab2b40c8f8e2f365c078cea37ebd7714ff3e16ccdbfdb5 | Triage

Analysis

max time kernel
53s
max time network
138s
platform
windows10_x64
resource
win10-20220414-en
submitted
14-05-2022 15:15

Sharing

Report Analysis Logs

General

Target

169aae931dfec389edab2b40c8f8e2f365c078cea37ebd7714ff3e16ccdbfdb5.dll
Size

532KB
MD5

f120272e5bf4ae26ac7308f42be5988d
SHA1

d9143a5330d00ced717d7d07eada6232425ca41c
SHA256

169aae931dfec389edab2b40c8f8e2f365c078cea37ebd7714ff3e16ccdbfdb5
SHA512

8ba13a52baf988a8b4c1967fb3598946a5ab4d9cc63952e37f709a2f6e46e470c131c80cecc5975f4c7ed7df826fda67eae2162c93d51d5cc3277e835688268d

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3788 regsvr32.exe
3788 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2064 regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2064 wrote to memory of 3788	2064	regsvr32.exe	regsvr32.exe
PID 2064 wrote to memory of 3788	2064	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\169aae931dfec389edab2b40c8f8e2f365c078cea37ebd7714ff3e16ccdbfdb5.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SZNCuVtr\lNyaeHanlBLNyoN.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-118-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/3788-123-0x0000000000000000-mapping.dmp

Download