emotet | 5bebb352f12bf244822fdc6f5951188f607180e33c78a30015cdcd72e86801eb | Triage™

Analysis

max time kernel
70s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
29/06/2022, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e16fcdf5858d1b5b32378930396a68ef.dll
Size 636KB
Sample220629-lbwepaaag4
SHA256 5bebb352f12bf244822fdc6f5951188f607180e33c78a30015cdcd72e86801eb
MD5 e16fcdf5858d1b5b32378930396a68ef
SHA1 03ea43ce8b251602bb517bfffdccf1435c748dff
SHA512 962f6965c5766cfabb3d25310ff586496c020a35cbe23a4e4136298787aef09c62cc4700c7eaf8f69fc332d34b32908def091b9ff8fad4134a61e5ac5206a88c
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker suricata trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	regsvr32.exe
8	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 8	1252	regsvr32.exe	82
PID 1252 wrote to memory of 8	1252	regsvr32.exe	82
PID 1252 wrote to memory of 8	1252	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e16fcdf5858d1b5b32378930396a68ef.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e16fcdf5858d1b5b32378930396a68ef.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-131-0x0000000002E10000-0x0000000002E33000-memory.dmp

Download