emotet | 0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7

Analysis

Target
emotet_exe_e5_0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7_2022-02-24__101808.dll
Size 645KB
Sample220224-mcjb7aeaem
SHA256 0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7
MD5 08573daadb476c3762624a9a6134f86c
SHA1 5e6df32f8c17240236c60a768eead6b7c7f248eb
SHA512 94df6c49b2f325646017fa640cb024144838e85b68d909cede66483a902b387123a1dbda6a7070daf4fe8bee4218e8ac2fe8a67da35c012b1d159430fa173525
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mtgqoizypbuniqtu\nbsabcumipbin.iow	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
588	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
760	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 1664 wrote to memory of 760	1664	regsvr32.exe	27
PID 760 wrote to memory of 588	760	regsvr32.exe	28
PID 760 wrote to memory of 588	760	regsvr32.exe	28
PID 760 wrote to memory of 588	760	regsvr32.exe	28
PID 760 wrote to memory of 588	760	regsvr32.exe	28
PID 760 wrote to memory of 588	760	regsvr32.exe	28
PID 760 wrote to memory of 588	760	regsvr32.exe	28
PID 760 wrote to memory of 588	760	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7_2022-02-24__101808.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7_2022-02-24__101808.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Mtgqoizypbuniqtu\nbsabcumipbin.iow"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:588

memory/760-55-0x00000000753E1000-0x00000000753E3000-memory.dmp

Download

memory/760-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1664-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Download