emotet | 3f539be1c8fa525b1e24f4fab9cf4cb3ea33b49eb11fc7938968333d976f0c6d | Triage™

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
18/05/2022, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d74b72479814da0930278a021a4735de.dll
Size 465KB
Sample220518-bkhj3sebdr
SHA256 3f539be1c8fa525b1e24f4fab9cf4cb3ea33b49eb11fc7938968333d976f0c6d
MD5 d74b72479814da0930278a021a4735de
SHA1 25092c6218631008951da013f0513f8575cd9019
SHA512 aa24d56802b46e5fc71b7c9ab71d4693168e87daa6dd833d3318d10c4ac740aeb26f8b86194c9a14604e3317dee6ea0938f84ae57a5f3376d8aac9c3c249f8fa
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	regsvr32.exe
1948	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1340	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1948	1340	regsvr32.exe	79
PID 1340 wrote to memory of 1948	1340	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d74b72479814da0930278a021a4735de.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KZczQuuPdQyelOt\dvnsePpEygumBb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-130-0x0000000180000000-0x0000000180032000-memory.dmp

Download