emotet | 2c08988e554dc91e11263752510b5c88eb89e97beaddfd7140780ef77daf5ca6

Analysis

Target
emotet_exe_e4_2c08988e554dc91e11263752510b5c88eb89e97beaddfd7140780ef77daf5ca6_2022-02-25__000016.dll
Size 1.0MB
Sample220225-aazvyafbfp
SHA256 2c08988e554dc91e11263752510b5c88eb89e97beaddfd7140780ef77daf5ca6
MD5 4dec83849fc0361a518e2912432b01aa
SHA1 148e7002c9ea894b9e7c2a9c43c7f6dd9b49643c
SHA512 2fe5ed613ee41a5534d0c71b72fc966d694584d335cd4fd0a580f24dab2efa28b0f7fcedff48ab7794a5dd3d28bc5fe40a98f2bf5f9138b0267c4a9c8268a05f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1092	1636	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c08988e554dc91e11263752510b5c88eb89e97beaddfd7140780ef77daf5ca6_2022-02-25__000016.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c08988e554dc91e11263752510b5c88eb89e97beaddfd7140780ef77daf5ca6_2022-02-25__000016.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

memory/1092-56-0x0000000075021000-0x0000000075023000-memory.dmp

Download

memory/1092-57-0x0000000000210000-0x0000000000235000-memory.dmp

Download

memory/1636-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Download