emotet | 2fb2fc55e77a7ac92d8b3e2798581f1b17fb2ec8843fa1dd582e1063cf3f7f64

Analysis

Target
emotet_exe_e5_2fb2fc55e77a7ac92d8b3e2798581f1b17fb2ec8843fa1dd582e1063cf3f7f64_2022-03-04__000304.dll
Size 611KB
Sample220304-adfapseefm
SHA256 2fb2fc55e77a7ac92d8b3e2798581f1b17fb2ec8843fa1dd582e1063cf3f7f64
MD5 d3921e7d2d7f54047844bf71eebd2007
SHA1 0a5c5b7d9ed3a8fc391c9353218f04bd3e3eb930
SHA512 3a3922ebb9e6e4f77f7c5d6dc21c52468ecf81cb1ce03296418055f4647d44f1f540285c1bd3b00d9688c08c2cf4f3bd8934c87d5852d17b7c5c4fa16edc75dc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
876	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27
PID 1104 wrote to memory of 876	1104	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2fb2fc55e77a7ac92d8b3e2798581f1b17fb2ec8843fa1dd582e1063cf3f7f64_2022-03-04__000304.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2fb2fc55e77a7ac92d8b3e2798581f1b17fb2ec8843fa1dd582e1063cf3f7f64_2022-03-04__000304.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876

memory/876-55-0x0000000076771000-0x0000000076773000-memory.dmp

Download

memory/876-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1104-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download