emotet | 2c2fb92f819eb48603d5d1c10f09f833eabf466fcf1cbe7a9443fdff96c99595 | Triage™

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
18/05/2022, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca399c7a4532124bd8fa5e45582febcf.dll
Size 405KB
Sample220518-bfhdhsbdc6
SHA256 2c2fb92f819eb48603d5d1c10f09f833eabf466fcf1cbe7a9443fdff96c99595
MD5 ca399c7a4532124bd8fa5e45582febcf
SHA1 780c3bef812a6ba5727e79eaa1805f7b0c359a86
SHA512 e29013780d2619e3a2931ca17a3f56b09e2e74dfe6f0d509d5a0dd4a2b2d505d6ef4b9e66e635a050b4340dc1e2fa3cc1dee8a74eab138f710c5b67bb3341c4f
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	regsvr32.exe
1232	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2912	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1232	2912	regsvr32.exe	81
PID 2912 wrote to memory of 1232	2912	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca399c7a4532124bd8fa5e45582febcf.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XQFXj\VDZXgrUf.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-130-0x0000000180000000-0x000000018002F000-memory.dmp

Download