emotet | 18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519

Analysis

Target
emotet_exe_e4_18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519_2022-02-22__171219.dll
Size 472KB
Sample220222-vreasacfap
SHA256 18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519
MD5 35bcdf63d2497aad855ec4e52c177d75
SHA1 419b970b667b734d718ff0aeeacea8f3dd39302f
SHA512 c82f9cbeda0c5fc2c0f30e696c14f7850a4adfd8833f1c171bef8586ac9eed64c91e61bfb96ae66867eef5f925d33469ef5b5e6498c763507011336430609072
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1592	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27
PID 1400 wrote to memory of 1592	1400	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519_2022-02-22__171219.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_18523d8d2c155f96037fded23db475d574a20efddd5d707708cd1aefeb2d3519_2022-02-22__171219.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592

memory/1400-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/1592-55-0x0000000076C91000-0x0000000076C93000-memory.dmp

Download

memory/1592-56-0x00000000004B0000-0x00000000004D6000-memory.dmp

Download