emotet | b8ba8faf3f7e2eb2c0b0d7b5a82ed8036340974fca12e87333b7cfc863bf0405 | Triage™

Analysis

max time kernel
90s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0255899935664d4bea4a1ec43df164a.dll
Size 736KB
Sample220520-cb4xdsebg8
SHA256 b8ba8faf3f7e2eb2c0b0d7b5a82ed8036340974fca12e87333b7cfc863bf0405
MD5 f0255899935664d4bea4a1ec43df164a
SHA1 7f49b0ec0a3fe3cce274eb0f3b9cb8cb6aa18641
SHA512 8cbae17c3c877060ff9ff3c33e5f89ca688fb49778abedcd926cbf291afd16bb8c5e0806c05dec26c98cd36ce97e91916068e55661b2bbd3390d96038fa2f725
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	regsvr32.exe
1680	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3508	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1680	3508	regsvr32.exe	85
PID 3508 wrote to memory of 1680	3508	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f0255899935664d4bea4a1ec43df164a.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FNsqBKaWFtpkcE\udBakmbCsllvA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3508-130-0x0000000180000000-0x000000018002F000-memory.dmp

Download