emotet | 53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85

Analysis

Target
emotet_exe_e5_53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85_2022-03-17__214458.dll
Size 780KB
Sample220317-1mba8afebr
SHA256 53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85
MD5 449dd5bdeb65d221462c1352a7dab892
SHA1 031c5028b4fff05518c0f70894a8c439f3bca5f9
SHA512 c78857858f5ee58e970ea1759732e1b45006bf145a1179a2eb80bbaa820c140d50b11880dce1ab5cc419b95cbff1cdf94ecc2972f8a2aef5f306af8c0140658d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/2012-134-0x00000000026E0000-0x000000000272C000-memory.dmp	Emotet4
behavioral2/memory/3560-139-0x0000000002860000-0x00000000028AC000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
3560	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aimxaybspkbujx\apamwhnxvfrxfv.iau	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3560	regsvr32.exe
3560	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2012	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2012	3524	regsvr32.exe	82
PID 3524 wrote to memory of 2012	3524	regsvr32.exe	82
PID 3524 wrote to memory of 2012	3524	regsvr32.exe	82
PID 2012 wrote to memory of 3560	2012	regsvr32.exe	87
PID 2012 wrote to memory of 3560	2012	regsvr32.exe	87
PID 2012 wrote to memory of 3560	2012	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85_2022-03-17__214458.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85_2022-03-17__214458.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Aimxaybspkbujx\apamwhnxvfrxfv.iau"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3560

memory/2012-134-0x00000000026E0000-0x000000000272C000-memory.dmp

Download

memory/3560-139-0x0000000002860000-0x00000000028AC000-memory.dmp

Download