emotet | 298a437e99c8270c873de234e6e33149b6825871f049c0a73d3ca951df083e39 | Triage™

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25/05/2022, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53f0a664fde258a94848039b4dfe93c2.dll
Size 784KB
Sample220525-kapp3shdc3
SHA256 298a437e99c8270c873de234e6e33149b6825871f049c0a73d3ca951df083e39
MD5 53f0a664fde258a94848039b4dfe93c2
SHA1 712c0d3786f6256e5035e15862800cab69641665
SHA512 86bf1b960ba162ab14f5e34ddd3638b37b3dc2ed74dc3abde9859f86b6649cf30e9fffa4cfaed81c59c02f8a530a78cc02fc0dd6757c51d35b1868c6de9e0b79
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	regsvr32.exe
4328	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3196	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4328	3196	regsvr32.exe	79
PID 3196 wrote to memory of 4328	3196	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\53f0a664fde258a94848039b4dfe93c2.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RqQuMrtbrqBxAXdA\nElrPbsWNPc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-130-0x0000000002EF0000-0x0000000002F21000-memory.dmp

Download