emotet | 8bec83adf9c36637f05a4582f5b1757336cb3b4233dffd0bae309205e1cdfbf9 | Triage™

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
18/05/2022, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee0494cdc95228430235e8ee75d5fec5.dll
Size 405KB
Sample220518-d1dbeafdfp
SHA256 8bec83adf9c36637f05a4582f5b1757336cb3b4233dffd0bae309205e1cdfbf9
MD5 ee0494cdc95228430235e8ee75d5fec5
SHA1 bce41ff5a3b6c5a0093f93464bd18e6f1bc33bf1
SHA512 5fb8d96dfe2e887fc303a12d38b72fe054aef07971db20ed05a17d16cd29dcd8e1d6c66de280fe08397e505fc745e97ce93779a32eb7e8a2c7888805b50d6a8b
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3640	regsvr32.exe
3640	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2684	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3640	2684	regsvr32.exe	81
PID 2684 wrote to memory of 3640	2684	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ee0494cdc95228430235e8ee75d5fec5.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PaWSQeEWFqaWsOZ\NsJlAkGvs.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-130-0x0000000180000000-0x000000018002F000-memory.dmp

Download