emotet | 4f1eb35a7e277488c00350d392687ee12d49805d004db624d3dc229e4c9d8fae | Triage™

Analysis

max time kernel
84s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/05/2022, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5639dbfee776685652757e6ef04098a0.dll
Size 465KB
Sample220517-svq3msgfcr
SHA256 4f1eb35a7e277488c00350d392687ee12d49805d004db624d3dc229e4c9d8fae
MD5 5639dbfee776685652757e6ef04098a0
SHA1 bf84ff83435b9b79040ced9d90a83f2b04c9a876
SHA512 b777e6a9280b70dfb0ec24cc2f879aecdbf81ac361c77770cde4c9803861cc18d482bfe159319210691acc2b04c92101cb0cd711cf6a8e37bb377daa2fee0b5e
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	regsvr32.exe
3316	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3880	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3316	3880	regsvr32.exe	83
PID 3880 wrote to memory of 3316	3880	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5639dbfee776685652757e6ef04098a0.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NNPIZGjoyASdI\LPTqRDcacnbc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3880-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download