emotet | aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f

Analysis

Target
emotet_exe_e5_aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f_2022-03-17__214458.dll
Size 780KB
Sample220317-1mmdgsfecl
SHA256 aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f
MD5 4e555b7027720c4e63e1df68cbb2bfa6
SHA1 6a0aacc74fd32406528ae38c9452c5314a1a6978
SHA512 290a4ea789ff7846a9a1ceda11ef671b4ff61d6231fb893400f80859d75c52a8b604d8bdf558eb0ac7937f1922555d032c4aed93f69c6c5ebbe2099e697403ea
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/1652-130-0x0000000002E30000-0x0000000002E7C000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	regsvr32.exe
1652	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1652	1516	regsvr32.exe	79
PID 1516 wrote to memory of 1652	1516	regsvr32.exe	79
PID 1516 wrote to memory of 1652	1516	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f_2022-03-17__214458.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f_2022-03-17__214458.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652

memory/1652-130-0x0000000002E30000-0x0000000002E7C000-memory.dmp

Download