emotet | 908c12b2aa974108dc46a5c2ab8e6d7f4634c5b155f0707a566ea2a8bc40f599

Analysis

Target
emotet_exe_e4_908c12b2aa974108dc46a5c2ab8e6d7f4634c5b155f0707a566ea2a8bc40f599_2022-02-25__000013.dll
Size 652KB
Sample220225-aazj6sfbep
SHA256 908c12b2aa974108dc46a5c2ab8e6d7f4634c5b155f0707a566ea2a8bc40f599
MD5 04ebe1bc43691881c549b868d66f3bb1
SHA1 c2ea69d35603ee2aea2951a438e8bded8afbaddb
SHA512 3ed11b8717089972d747cdc85a7e1c66e2f972ee56e12d2837a698aad3911b3111806dcb20209910ea53d844cab4fecb94d1039db4c79a06e548f9ff03f37aa1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1828	regsvr32.exe
1828	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1828	1444	regsvr32.exe	82
PID 1444 wrote to memory of 1828	1444	regsvr32.exe	82
PID 1444 wrote to memory of 1828	1444	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_908c12b2aa974108dc46a5c2ab8e6d7f4634c5b155f0707a566ea2a8bc40f599_2022-02-25__000013.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_908c12b2aa974108dc46a5c2ab8e6d7f4634c5b155f0707a566ea2a8bc40f599_2022-02-25__000013.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828

memory/1828-130-0x0000000010000000-0x0000000010026000-memory.dmp

Download