emotet | 68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5

Analysis

Target
emotet_exe_e5_68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5_2022-03-17__214457.dll
Size 780KB
Sample220317-1mba8afcc2
SHA256 68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5
MD5 35c7c30a0d63516f1fd805a7135bae26
SHA1 b98d4458ba9875179c449df860eb8c933f180524
SHA512 f26cab3afeafa0760c76e3306512bdd2319be345f4f436561610b7edd67ddb0553e407531c123e7b5b61d518ac5682b250c8946b44f02fa27bc9f77881300103
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral1/memory/1088-56-0x0000000000A00000-0x0000000000A4C000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1088	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1088	744	regsvr32.exe	27
PID 744 wrote to memory of 1088	744	regsvr32.exe	27
PID 744 wrote to memory of 1088	744	regsvr32.exe	27
PID 744 wrote to memory of 1088	744	regsvr32.exe	27
PID 744 wrote to memory of 1088	744	regsvr32.exe	27
PID 744 wrote to memory of 1088	744	regsvr32.exe	27
PID 744 wrote to memory of 1088	744	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5_2022-03-17__214457.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5_2022-03-17__214457.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

memory/744-54-0x000007FEFBB61000-0x000007FEFBB63000-memory.dmp

Download

memory/1088-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download

memory/1088-56-0x0000000000A00000-0x0000000000A4C000-memory.dmp

Download