emotet | 0fc7288745338ef91c2bebb6471ba8f6f98a90cbd645c7683f2581fabd5cc1a2

Analysis

Target
emotet_exe_e4_0fc7288745338ef91c2bebb6471ba8f6f98a90cbd645c7683f2581fabd5cc1a2_2022-03-02__165508.dll
Size 599KB
Sample220302-vfpblshcgr
SHA256 0fc7288745338ef91c2bebb6471ba8f6f98a90cbd645c7683f2581fabd5cc1a2
MD5 dab2a73fa4e570a7517c30a245efaeeb
SHA1 40be036e2dd599cc94e83751125c790fc3a21b2d
SHA512 1145342c0ea40cfaa62e0948f04d936436629bd5551b4b3a9bc4eded771960ae167dc6d95aa0d31767fc68dc7a15d18b9fe864f378b6c9d1fb9213135cb0fa46
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1500	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27
PID 1180 wrote to memory of 1500	1180	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fc7288745338ef91c2bebb6471ba8f6f98a90cbd645c7683f2581fabd5cc1a2_2022-03-02__165508.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fc7288745338ef91c2bebb6471ba8f6f98a90cbd645c7683f2581fabd5cc1a2_2022-03-02__165508.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500

memory/1180-55-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download

memory/1500-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1500-57-0x0000000010000000-0x0000000010028000-memory.dmp

Download