emotet | 26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6

Analysis

Target
emotet_exe_e5_26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6_2022-03-17__214455.dll
Size 780KB
Sample220317-1l3dbafebk
SHA256 26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6
MD5 b5a8f966b199fc5725f42b8f2c9e9608
SHA1 65f3297fc6b811875ed8bda508b10e514a6410b1
SHA512 fb100dd6db8ef21f53fcaec3cc43a657f6b68d7a6564b87b632a0fbdff9372108853602a3743c6f0137dd33e022f1cdd59f1602a59a2ceb3b2773ffbb173fd5b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/4492-134-0x0000000002470000-0x00000000024BC000-memory.dmp	Emotet4
behavioral2/memory/3692-139-0x0000000002BA0000-0x0000000002BEC000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
3692	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hkkwwwlfkgbs\uvzk.jbj	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3692	regsvr32.exe
3692	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4492	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4492	3460	regsvr32.exe	82
PID 3460 wrote to memory of 4492	3460	regsvr32.exe	82
PID 3460 wrote to memory of 4492	3460	regsvr32.exe	82
PID 4492 wrote to memory of 3692	4492	regsvr32.exe	89
PID 4492 wrote to memory of 3692	4492	regsvr32.exe	89
PID 4492 wrote to memory of 3692	4492	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6_2022-03-17__214455.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6_2022-03-17__214455.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Hkkwwwlfkgbs\uvzk.jbj"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3692

memory/3692-139-0x0000000002BA0000-0x0000000002BEC000-memory.dmp

Download

memory/4492-134-0x0000000002470000-0x00000000024BC000-memory.dmp

Download