emotet | 31e23df39f9662cc5dcb3f2e99ac8acc9b83ff7c6eee543fbb0ea3c4691cb9bf | Triage™

Analysis

max time kernel
97s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/05/2022, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bdbfa4ddff8f0cb457595fd9901d7953.dll
Size 465KB
Sample220517-svq3msgfcq
SHA256 31e23df39f9662cc5dcb3f2e99ac8acc9b83ff7c6eee543fbb0ea3c4691cb9bf
MD5 bdbfa4ddff8f0cb457595fd9901d7953
SHA1 33f79805d5bdeba7e985ff8d533bf60bcb66469c
SHA512 74b2cb0dc173d55d23ebe41ed8c8a206e7ee6deba3e3b0b471db0e77e3e1b4f670ade86d69fc55ff60c3b3f62c2dd9545086f24d00dbbe8739b8c8226c2e612f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3720	regsvr32.exe
3720	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1880	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3720	1880	regsvr32.exe	81
PID 1880 wrote to memory of 3720	1880	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bdbfa4ddff8f0cb457595fd9901d7953.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WbZnyZhMONoo\nAtroGQxNJXX.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download