emotet | fe3bfb9bfddefbf1352d76776c5360205e58447879ae11a2b11c0b3b71ccc5aa

Analysis

Target
emotet_exe_e5_fe3bfb9bfddefbf1352d76776c5360205e58447879ae11a2b11c0b3b71ccc5aa_2022-03-08__000129.dll
Size 400KB
Sample220308-abg2hsccen
SHA256 fe3bfb9bfddefbf1352d76776c5360205e58447879ae11a2b11c0b3b71ccc5aa
MD5 5a5250dc6482c2b5de80235c46f9bd4b
SHA1 d759692b208c3512ff5c77ef634651bbe169c303
SHA512 7f40cc5a2b7b635fe8f92933ab36a8e4a0e7390401436fbc456af6d5dd66fc5db3c9c735dc3d7d1b5e5d65b74574f32742ee94a5777308571f758a1fc6f7b179
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
868	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27
PID 1764 wrote to memory of 868	1764	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fe3bfb9bfddefbf1352d76776c5360205e58447879ae11a2b11c0b3b71ccc5aa_2022-03-08__000129.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fe3bfb9bfddefbf1352d76776c5360205e58447879ae11a2b11c0b3b71ccc5aa_2022-03-08__000129.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868

memory/868-55-0x0000000075F71000-0x0000000075F73000-memory.dmp

Download

memory/868-56-0x0000000000210000-0x0000000000237000-memory.dmp

Download

memory/1764-54-0x000007FEFC1E1000-0x000007FEFC1E3000-memory.dmp

Download