emotet | 7d5d3b9b6f00ffcda723ec7f7156d94d5f84ee321b3ba71e8f6950192fc35ca5 | Triage™

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25/05/2022, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b386c68ce3b67a57b9df5f928640d495.dll
Size 784KB
Sample220525-kbabsadbhm
SHA256 7d5d3b9b6f00ffcda723ec7f7156d94d5f84ee321b3ba71e8f6950192fc35ca5
MD5 b386c68ce3b67a57b9df5f928640d495
SHA1 b67732ac890e2ab94fa21de558f720a65fa755f1
SHA512 1f69cabcca7474dbb6283f12b2b5c1cfd85942248f6ad74c2b065f30be5212fdb55b402c457bae2a1e74e0a56007a4c89191fc1bd6e460fc0ec46f90d9e605eb
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3768	regsvr32.exe
3768	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2404	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3768	2404	regsvr32.exe	77
PID 2404 wrote to memory of 3768	2404	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b386c68ce3b67a57b9df5f928640d495.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SSWqsR\xxxmE.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-130-0x0000000002660000-0x0000000002691000-memory.dmp

Download