emotet | 8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa

Analysis

Target
emotet_exe_e4_8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa_2022-02-24__000214.dll
Size 664KB
Sample220224-ab22pachgl
SHA256 8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa
MD5 30d78a968b101bf2f18761656872211f
SHA1 5f6afd1c03857ea70874095b2567ab74372e35bb
SHA512 aa39c5739ee3fcec82f3ec7ff8fd6f6c47cb7676d3d60dd5d3634bba8eaeb208dc422d6133b6f6f11a9a499fb4d844054df2706c5d09592906dccbe54f756bbf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2464	regsvr32.exe
2464	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2464	2368	regsvr32.exe	60
PID 2368 wrote to memory of 2464	2368	regsvr32.exe	60
PID 2368 wrote to memory of 2464	2368	regsvr32.exe	60

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa_2022-02-24__000214.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa_2022-02-24__000214.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464

memory/2464-130-0x0000000005000000-0x0000000005026000-memory.dmp

Download