emotet | 2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9

Analysis

Target
emotet_exe_e4_2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9_2022-03-15__000447.dll
Size 997KB
Sample220315-adbbragaar
SHA256 2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9
MD5 a62f1268de7d8d603fcf7eeb6838b831
SHA1 74f184cb3739c518bd640bd1cffe4a67e853260b
SHA512 85e9267d821a96bf1e30171524bba86f7061a3574626746bb43299476c2754e2e0be49aef41eb26791f0d8c75635e95f1643a63c51410950a51b812300f6607b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4252	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Esyegrfomn\zixgpgotne.vcm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4252	regsvr32.exe
4252	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4744	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 4744	796	regsvr32.exe	82
PID 796 wrote to memory of 4744	796	regsvr32.exe	82
PID 796 wrote to memory of 4744	796	regsvr32.exe	82
PID 4744 wrote to memory of 4252	4744	regsvr32.exe	83
PID 4744 wrote to memory of 4252	4744	regsvr32.exe	83
PID 4744 wrote to memory of 4252	4744	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9_2022-03-15__000447.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2f908080e27987e2a50ec057b9254201ebf37f9efbb22709f168b66156dcb0a9_2022-03-15__000447.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Esyegrfomn\zixgpgotne.vcm"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4252

memory/4744-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download