emotet | b7aeb8c9276a6adcb259d0d792392b25df7c1204d8c8cf6fdfa00a83d42a05b5

Analysis

Target
emotet_exe_e4_b7aeb8c9276a6adcb259d0d792392b25df7c1204d8c8cf6fdfa00a83d42a05b5_2022-02-25__000015.dll
Size 652KB
Sample220225-aazvyafbfk
SHA256 b7aeb8c9276a6adcb259d0d792392b25df7c1204d8c8cf6fdfa00a83d42a05b5
MD5 ae19bb4ea9ec37cff59aadde07a58101
SHA1 17a47d3b03213880b07d5bdaf5c73117cd400218
SHA512 fa1de5da27c4f879223a06e22df4e9b3205a2b001e135e1b9d0f2cea57ced904deefc2ca19214f5a3fa6d3798abadcb852c0c2e037cd42790646567d2a5a3cbc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4056	regsvr32.exe
4056	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4056	752	regsvr32.exe	57
PID 752 wrote to memory of 4056	752	regsvr32.exe	57
PID 752 wrote to memory of 4056	752	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b7aeb8c9276a6adcb259d0d792392b25df7c1204d8c8cf6fdfa00a83d42a05b5_2022-02-25__000015.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b7aeb8c9276a6adcb259d0d792392b25df7c1204d8c8cf6fdfa00a83d42a05b5_2022-02-25__000015.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056

memory/4056-130-0x0000000010000000-0x0000000010026000-memory.dmp

Download