emotet | e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657

Analysis

Target
emotet_exe_e5_e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657_2022-03-17__214456.dll
Size 780KB
Sample220317-1ma1fsfebp
SHA256 e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657
MD5 fb746cb1eeb121ec378cc12896c1e79d
SHA1 2e669796dbfb4109198965b90de7148fd87c1dd6
SHA512 76ab1a3fd9f1b1d7dd4e8261b4c30166974965bf0a39a75f8dc9609b079afd78e2b3a4c31b952a433646e008e3b2f885f5971ba12099ef4227ff85ae54fc01cf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/4520-134-0x00000000021A0000-0x00000000021EC000-memory.dmp	Emotet4
behavioral2/memory/3220-139-0x0000000002140000-0x000000000218C000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
3220	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hvjvep\fsir.dwi	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	regsvr32.exe
3220	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4520	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4520	4300	regsvr32.exe	82
PID 4300 wrote to memory of 4520	4300	regsvr32.exe	82
PID 4300 wrote to memory of 4520	4300	regsvr32.exe	82
PID 4520 wrote to memory of 3220	4520	regsvr32.exe	88
PID 4520 wrote to memory of 3220	4520	regsvr32.exe	88
PID 4520 wrote to memory of 3220	4520	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657_2022-03-17__214456.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657_2022-03-17__214456.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Hvjvep\fsir.dwi"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3220

memory/3220-139-0x0000000002140000-0x000000000218C000-memory.dmp

Download

memory/4520-134-0x00000000021A0000-0x00000000021EC000-memory.dmp

Download