emotet | c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e

Analysis

Target
emotet_exe_e4_c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e_2022-03-17__000018.dll
Size 736KB
Sample220317-aawtaaffel
SHA256 c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e
MD5 306d53081c154f268418a508ea3e6c9e
SHA1 fb46ca6da4be0f4d5c449268b4d637aa9c09d2e7
SHA512 44ecc6d07da10d7b12b7c0dfc5e8f6e3a2543144880ff7df5b678e9ae40df90e2bbcbc7d24c38f168164f90d205102db950ee8b5f598043f45f45a95bf115dd5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4044	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kocbodkjkfhkeujv\exouuyaammezxy.rgo	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4044	regsvr32.exe
4044	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4444	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4444	5040	regsvr32.exe	82
PID 5040 wrote to memory of 4444	5040	regsvr32.exe	82
PID 5040 wrote to memory of 4444	5040	regsvr32.exe	82
PID 4444 wrote to memory of 4044	4444	regsvr32.exe	90
PID 4444 wrote to memory of 4044	4444	regsvr32.exe	90
PID 4444 wrote to memory of 4044	4444	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e_2022-03-17__000018.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e_2022-03-17__000018.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kocbodkjkfhkeujv\exouuyaammezxy.rgo"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4044

memory/4044-139-0x0000000002430000-0x0000000002465000-memory.dmp

Download

memory/4444-134-0x00000000022B0000-0x00000000022E5000-memory.dmp

Download