emotet | 4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9

Analysis

Target
emotet_exe_e4_4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9_2022-03-16__064820.dll
Size 664KB
Sample220316-hlchsagegn
SHA256 4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9
MD5 2ed6e3059f46e32e3c17acd6381b0b6d
SHA1 905d9b95608bf9eb7c1213beabb31380938847d2
SHA512 5da71a2c0af7e91e1bb6c3aa1d797908f767520c6cdf55530cdf0849123ac77140cc17b87e766547e7fca3fb65ca1cda9d237b9c794e4a1eabf0eab4cdf3afb6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4144	regsvr32.exe
4144	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4144	3548	regsvr32.exe	79
PID 3548 wrote to memory of 4144	3548	regsvr32.exe	79
PID 3548 wrote to memory of 4144	3548	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9_2022-03-16__064820.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9_2022-03-16__064820.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

memory/4144-131-0x00000000026E0000-0x0000000002715000-memory.dmp

Download