emotet | 4d793fc1bbdc76784f4bb8d4bf19cde7fd08bc8a27a9616645d873dc036d9fa1 | Triage™

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/05/2022, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5dbaaf3798061e9727e55d90a386a735.dll
Size 356KB
Sample220521-defjmsfec9
SHA256 4d793fc1bbdc76784f4bb8d4bf19cde7fd08bc8a27a9616645d873dc036d9fa1
MD5 5dbaaf3798061e9727e55d90a386a735
SHA1 7c9e9640eb72052d738b8e53f2078445095b0b43
SHA512 89ff46386940d1cef0dcc7828444f92bd7596ae2fd970b8ca82be317472eb994779a2a4f8e58aa174fc527ac47c96a06f54946257000d2267321e181f16ebec2
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3936	regsvr32.exe
3936	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1136	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 3936	1136	regsvr32.exe	79
PID 1136 wrote to memory of 3936	1136	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5dbaaf3798061e9727e55d90a386a735.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KIjLhEKhJjmjg\eVwJkctLk.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-130-0x0000000180000000-0x000000018002F000-memory.dmp

Download