emotet | 70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb

Analysis

Target
emotet_exe_e4_70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb_2022-03-03__005423.dll
Size 624KB
Sample220303-a9tszaaeel
SHA256 70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb
MD5 6b90bfa214fbb76b340b3ec0de0c8d4a
SHA1 f7a3c245aac5e621caeca5558678805c802b1264
SHA512 3f7fbac6ff9542c89a49641a800149d0c3c8308cf6b2e8de53e0aa2fb8dae7fedc47f91cceb10b357a4c8edd99a6aca97027ef57237dc9f2bac3f8f8278943af
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	regsvr32.exe
2036	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2036	1720	regsvr32.exe	79
PID 1720 wrote to memory of 2036	1720	regsvr32.exe	79
PID 1720 wrote to memory of 2036	1720	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb_2022-03-03__005423.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_70499db86c6f304ad9f2476bbbc658e14938c0d0ac7fc554b7d2d6554bd478bb_2022-03-03__005423.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

memory/2036-130-0x0000000002F00000-0x0000000002F28000-memory.dmp

Download