emotet | dae082fefc519861675ea5aaaae54477c74014ff290949fcae02ad088f2977f1 | Triage™

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/05/2022, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
870e94a9898eb8ccf7b26c50db2c4393.dll
Size 422KB
Sample220517-kbvbyscabm
SHA256 dae082fefc519861675ea5aaaae54477c74014ff290949fcae02ad088f2977f1
MD5 870e94a9898eb8ccf7b26c50db2c4393
SHA1 dd89c65b4a5fddf9ea89d1ffb563c55afe294a4f
SHA512 14803360b6870e5832b2ab88442636f4a892c4d6eaae29c65d173c2fcef9a0bf22cd86096a920b5a17ee021ff801aab5adcfbeef77e7af8509e2f232b9a36492
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3676	regsvr32.exe
3676	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3400	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3676	3400	regsvr32.exe	77
PID 3400 wrote to memory of 3676	3400	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\870e94a9898eb8ccf7b26c50db2c4393.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AqXaluBwvfHa\Kumz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3400-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download