emotet | 95d0519cec69e64ac5cc72d2b1e9f57bbf67606a90eacc451ec63d6e841e48d4 | Triage™

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19/05/2022, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8i0xhPv1QoOroH.dll
Size 757KB
Sample220519-rbjc1sbbdn
SHA256 95d0519cec69e64ac5cc72d2b1e9f57bbf67606a90eacc451ec63d6e841e48d4
MD5 dfb3f371e06e49e616584c14ecd53d37
SHA1 fa35263727c76ff9a30a7a6c0a34be1067e6e800
SHA512 2a55f4c2329b50b320ef61f10f56ee8eb080cf6858579b690f555941596334d4d6901c268b3da57b75e05e3fc38ac5080d03d3190cfe558da976ea1bd7b7f288
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3492	regsvr32.exe
3492	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1836	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3492	1836	regsvr32.exe	79
PID 1836 wrote to memory of 3492	1836	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8i0xhPv1QoOroH.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JtZXZnRobDyqzt\SdJugxiTixTY.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-130-0x0000000180000000-0x000000018002F000-memory.dmp

Download