emotet | d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046

Analysis

Target
emotet_exe_e5_d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046_2022-03-16__000333.dll
Size 668KB
Sample220316-acmcmafaem
SHA256 d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046
MD5 4fb9fc21b873d19b82274bc8fc0fe839
SHA1 24b039f506e3e215fcbced9d61e86d7e151d2cd3
SHA512 0724d8f948bfcdf678855051531d206c495796c1affeadeab251513d4f528b1ca5e2feed7e7f76acaae38a9552a1e4b38fb6f948690231b084f579ff520d7446
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
1120	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Byrwbjmmhff\ksio.cxp	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1120	regsvr32.exe
1120	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4720	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4720	4768	regsvr32.exe	81
PID 4768 wrote to memory of 4720	4768	regsvr32.exe	81
PID 4768 wrote to memory of 4720	4768	regsvr32.exe	81
PID 4720 wrote to memory of 1120	4720	regsvr32.exe	89
PID 4720 wrote to memory of 1120	4720	regsvr32.exe	89
PID 4720 wrote to memory of 1120	4720	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046_2022-03-16__000333.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046_2022-03-16__000333.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Byrwbjmmhff\ksio.cxp"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1120

memory/1120-138-0x0000000003110000-0x0000000003137000-memory.dmp

Download

memory/4720-134-0x0000000002890000-0x00000000028B7000-memory.dmp

Download