emotet | fa2ca063043198373103b0791e89bb2e7e940f8e7aa9b69cde85572e81384eea

Analysis

Target
emotet_exe_e5_fa2ca063043198373103b0791e89bb2e7e940f8e7aa9b69cde85572e81384eea_2022-03-08__000130.dll
Size 400KB
Sample220308-abhm2sccfq
SHA256 fa2ca063043198373103b0791e89bb2e7e940f8e7aa9b69cde85572e81384eea
MD5 a274986daf3943ec5f7d82910393efea
SHA1 f44126d4c1a6f2a10bad137e00cf49b841aefdb1
SHA512 48b70f89595cdf5037a2fb635713557b8c627b4ed650a460f6340446c6ade77b08bbad88d073067fabcf77fc67f1e884c3963ecd6f163c74463545a0ed97ca66
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
756	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 756	952	regsvr32.exe	27
PID 952 wrote to memory of 756	952	regsvr32.exe	27
PID 952 wrote to memory of 756	952	regsvr32.exe	27
PID 952 wrote to memory of 756	952	regsvr32.exe	27
PID 952 wrote to memory of 756	952	regsvr32.exe	27
PID 952 wrote to memory of 756	952	regsvr32.exe	27
PID 952 wrote to memory of 756	952	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fa2ca063043198373103b0791e89bb2e7e940f8e7aa9b69cde85572e81384eea_2022-03-08__000130.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fa2ca063043198373103b0791e89bb2e7e940f8e7aa9b69cde85572e81384eea_2022-03-08__000130.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756

memory/756-55-0x00000000762A1000-0x00000000762A3000-memory.dmp

Download

memory/756-56-0x0000000000250000-0x0000000000277000-memory.dmp

Download

memory/952-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download