emotet | f7fa1bdfb49ed6c92c4996393acaa0a5744863ea8a6583be71ef4acf4b5d6e92

Analysis

Target
emotet_exe_e4_f7fa1bdfb49ed6c92c4996393acaa0a5744863ea8a6583be71ef4acf4b5d6e92_2022-02-26__133529.dll
Size 1024KB
Sample220226-qv874sccdk
SHA256 f7fa1bdfb49ed6c92c4996393acaa0a5744863ea8a6583be71ef4acf4b5d6e92
MD5 1131feaf356865968f74c0b00e53b7b1
SHA1 6d335037d7e022de3c79b1f41cd0c9e38516402b
SHA512 ce2aca8ea001f98752c40fa37e6b4244459b411445a6a70122054f996869dc095d7ca0ca5abab9fc30aaac27c1e9057895f7c54ba17f854306cdf99ae4f02446
MD5 SHA1 SHA512

Score

10^/10

Family

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1524	regsvr32.exe
1524	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1524	1352	regsvr32.exe	82
PID 1352 wrote to memory of 1524	1352	regsvr32.exe	82
PID 1352 wrote to memory of 1524	1352	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7fa1bdfb49ed6c92c4996393acaa0a5744863ea8a6583be71ef4acf4b5d6e92_2022-02-26__133529.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7fa1bdfb49ed6c92c4996393acaa0a5744863ea8a6583be71ef4acf4b5d6e92_2022-02-26__133529.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

memory/1524-130-0x0000000002590000-0x00000000025B8000-memory.dmp

Download