emotet | 24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49

Analysis

Target
emotet_exe_e5_24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49_2022-03-17__214455.dll
Size 780KB
Sample220317-1mmdgsfcc4
SHA256 24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49
MD5 4dbb844e24b3838fa91c1e317e6486be
SHA1 6f723758c358e19c5d90f65a5e9315b161fe422c
SHA512 a6da4c7c7ea017c68230e070a100413c45a29d22cf5353fd4a65400e900ff0290f750fb89ba92ac562d42dac978d12ce2b5d5a757b9bcdd77fdb7ed11befe681
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/2764-130-0x0000000003060000-0x00000000030AC000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2764	regsvr32.exe
2764	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2764	2740	regsvr32.exe	80
PID 2740 wrote to memory of 2764	2740	regsvr32.exe	80
PID 2740 wrote to memory of 2764	2740	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49_2022-03-17__214455.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49_2022-03-17__214455.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764

memory/2764-130-0x0000000003060000-0x00000000030AC000-memory.dmp

Download