emotet | 293b0120cd3bcca96f7bbcedf76005524112fa7a972543e41b78326d55bdcb76 | Triage™

Analysis

max time kernel
108s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/05/2022, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4586d8a69cd5f8746f139cd95137545b.dll
Size 538KB
Sample220515-db6awsfddr
SHA256 293b0120cd3bcca96f7bbcedf76005524112fa7a972543e41b78326d55bdcb76
MD5 4586d8a69cd5f8746f139cd95137545b
SHA1 e1219e9e5445176a8274908896bd525e27bf4409
SHA512 738f84b8a86fd06a32252531a7b9fed64e42edf50471f57cee9d8a50656ed39e343d4cc832f74700c2598793f3144b1ce8d3cb7090646eb95523c3977569688a
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	regsvr32.exe
4880	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2760	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4880	2760	regsvr32.exe	83
PID 2760 wrote to memory of 4880	2760	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4586d8a69cd5f8746f139cd95137545b.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OTteFMzpoimc\gjsZLKOCFNjdPG.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download