emotet | dbdbe1e46d20b345284721de5f11990137ecc40770e369768634ef1f52d9e7bb | Triage™

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22/05/2022, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d859466611b663b26b8f88b6c6b396e.dll
Size 612KB
Sample220522-axb3dshdel
SHA256 dbdbe1e46d20b345284721de5f11990137ecc40770e369768634ef1f52d9e7bb
MD5 4d859466611b663b26b8f88b6c6b396e
SHA1 cf04bea97bdd034deaecc4d666e0b6c572e15181
SHA512 e3d089aba241514911222df0ce982482bac19b4bf074c022608d6176a67a4f0f8f0947499d02fef2c85ddf2954e55c615fcba9da42cdc3fe40734754fb28b04c
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3196	regsvr32.exe
3196	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3196	4476	regsvr32.exe	81
PID 4476 wrote to memory of 3196	4476	regsvr32.exe	81
PID 4476 wrote to memory of 3196	4476	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d859466611b663b26b8f88b6c6b396e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d859466611b663b26b8f88b6c6b396e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-131-0x0000000002870000-0x0000000002894000-memory.dmp

Download