emotet | 0156ec023f2738166115f3c0601e2d1b82212033f4ed342e65d5f1e9d94bde2a

Analysis

Target
emotet_exe_e5_0156ec023f2738166115f3c0601e2d1b82212033f4ed342e65d5f1e9d94bde2a_2022-03-04__000304.dll
Size 611KB
Sample220304-adfapseefq
SHA256 0156ec023f2738166115f3c0601e2d1b82212033f4ed342e65d5f1e9d94bde2a
MD5 5d7d66f3d95e9cf8fed97384a6d1c18b
SHA1 ee42e054f11839e23ba7fbb1bbc94883d8f07f28
SHA512 95a12b18d0baf6d007abca2333c93540c35e77eb457351cceedd00bd8f29fe1944e9970e90d4b78655ce98fd6a723ea9aff032af82a0cb69d31fbf3478fbf54d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1444	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1444	1588	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0156ec023f2738166115f3c0601e2d1b82212033f4ed342e65d5f1e9d94bde2a_2022-03-04__000304.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0156ec023f2738166115f3c0601e2d1b82212033f4ed342e65d5f1e9d94bde2a_2022-03-04__000304.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

memory/1444-56-0x0000000075191000-0x0000000075193000-memory.dmp

Download

memory/1444-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1588-55-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Download