emotet | a97c2d074123e479e094e5f7df6a048be2d3aab2940d1629a8e3da9d1283f8bd

Analysis

Target
emotet_exe_e5_a97c2d074123e479e094e5f7df6a048be2d3aab2940d1629a8e3da9d1283f8bd_2022-03-07__082933.dll
Size 797KB
Sample220307-kd64jaehfj
SHA256 a97c2d074123e479e094e5f7df6a048be2d3aab2940d1629a8e3da9d1283f8bd
MD5 c8ebc2471a12fdedba9f6d8718cfe049
SHA1 8c3d5921b012cca8a458b6e4ee5d49c8906b88cf
SHA512 4bae3010b4b4a5fa97092a564e84ef060966a5367007dab4e64249ffcd45712f89dfee6994255be8de187ba565b624374e9bbb7d3c253c9f6f33b56af03f51bc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
564	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27
PID 1556 wrote to memory of 564	1556	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a97c2d074123e479e094e5f7df6a048be2d3aab2940d1629a8e3da9d1283f8bd_2022-03-07__082933.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a97c2d074123e479e094e5f7df6a048be2d3aab2940d1629a8e3da9d1283f8bd_2022-03-07__082933.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564

memory/564-55-0x00000000762A1000-0x00000000762A3000-memory.dmp

Download

memory/564-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1556-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download