emotet | dfe2277c7e914caeeed71df3b9f0eb30603d09a4a84202b1f44e403e543fb9b6

Analysis

Target
emotet_exe_e4_dfe2277c7e914caeeed71df3b9f0eb30603d09a4a84202b1f44e403e543fb9b6_2022-03-16__000409.dll
Size 688KB
Sample220316-ac7cssfafq
SHA256 dfe2277c7e914caeeed71df3b9f0eb30603d09a4a84202b1f44e403e543fb9b6
MD5 1ab49d253670b0ca4d97387cbd4d31d3
SHA1 54238eac456ae7f92720c66be18f8b04c0e65fdf
SHA512 0182e901bed651ce203347d37c3227fe81b3228f8aac2ff566d96f42e2462fc4bca7cce61f6073deaf9cdb64169e06536a3fe093dbe2a3029729dbcd843fae56
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	regsvr32.exe
4292	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4292	4564	regsvr32.exe	79
PID 4564 wrote to memory of 4292	4564	regsvr32.exe	79
PID 4564 wrote to memory of 4292	4564	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dfe2277c7e914caeeed71df3b9f0eb30603d09a4a84202b1f44e403e543fb9b6_2022-03-16__000409.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dfe2277c7e914caeeed71df3b9f0eb30603d09a4a84202b1f44e403e543fb9b6_2022-03-16__000409.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

memory/4292-130-0x0000000001370000-0x0000000001398000-memory.dmp

Download