emotet | a43cd7065dd54817412ae15166bc384bd14d768a388fd95fcd9eacc6ac4966ae

Analysis

Target
emotet_exe_e4_a43cd7065dd54817412ae15166bc384bd14d768a388fd95fcd9eacc6ac4966ae_2022-02-26__000232.dll
Size 932KB
Sample220226-ab2e6aafer
SHA256 a43cd7065dd54817412ae15166bc384bd14d768a388fd95fcd9eacc6ac4966ae
MD5 3a254df431d7511fb5be65e715c07dc3
SHA1 3050e03f6ebe90e399d1983e4fe775cfeb5c5237
SHA512 a71a4e162fc26f1f1acda2fbcbf6c9d0e0f09939c2bfdcd37fdc5647f5ac2adf037d878d1fcd1f40a5f56daea108f7324cb3eb2c6b2414beacf6782a1280c910
MD5 SHA1 SHA512

Score

10^/10

Family

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27
PID 1192 wrote to memory of 1720	1192	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a43cd7065dd54817412ae15166bc384bd14d768a388fd95fcd9eacc6ac4966ae_2022-02-26__000232.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a43cd7065dd54817412ae15166bc384bd14d768a388fd95fcd9eacc6ac4966ae_2022-02-26__000232.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

memory/1192-55-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download

memory/1720-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1720-57-0x00000000001C0000-0x00000000001E8000-memory.dmp

Download