emotet | 079ed226e6ddbb7ef893f77b6674947fd75cd3f259e4aca780fee68003ec5057

Analysis

Target
emotet_exe_e5_079ed226e6ddbb7ef893f77b6674947fd75cd3f259e4aca780fee68003ec5057_2022-03-04__000309.dll
Size 611KB
Sample220304-adflgaeegj
SHA256 079ed226e6ddbb7ef893f77b6674947fd75cd3f259e4aca780fee68003ec5057
MD5 8e6939ced921726aad0ade2dfdecdee5
SHA1 64b1915cd2cc70d6f23b7d7f6c1bb20de2ddde2e
SHA512 8a8d5a0717081409a9f8519671962e9fd98528a693d04cd683f6b6a2d82ccfe9c6fb70910cfae0aa1a41c1f2956f04824a1e0e5d560c3440a5fd4df18ad69585
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1532	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1532	1636	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_079ed226e6ddbb7ef893f77b6674947fd75cd3f259e4aca780fee68003ec5057_2022-03-04__000309.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_079ed226e6ddbb7ef893f77b6674947fd75cd3f259e4aca780fee68003ec5057_2022-03-04__000309.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

memory/1532-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Download

memory/1532-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1636-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Download