emotet | 0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf

Analysis

Target
emotet_exe_e5_0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf_2022-03-17__214455.dll
Size 780KB
Sample220317-1l3dbafcb6
SHA256 0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf
MD5 8f95313bb6acac26837097d10470dc63
SHA1 98adefb0372b28730b1e170e6a4f2a5588018a39
SHA512 8a02ec6c969dd184b4dbcb918d5e14fe250f55e1c39ee9cabe2c53fe8f333cf1f297294b025907071a5f4dd426b71ca0482a9f3e0221fc772a83e70066a7e8c1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/1860-130-0x0000000002970000-0x00000000029BC000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1860	regsvr32.exe
1860	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1860	1684	regsvr32.exe	80
PID 1684 wrote to memory of 1860	1684	regsvr32.exe	80
PID 1684 wrote to memory of 1860	1684	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf_2022-03-17__214455.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf_2022-03-17__214455.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860

memory/1860-130-0x0000000002970000-0x00000000029BC000-memory.dmp

Download