emotet | b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12

Analysis

Target
emotet_exe_e4_b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12_2022-03-17__171246.dll
Size 800KB
Sample220317-vreljsdag6
SHA256 b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12
MD5 4ad2fa7d4ff6e77382b07bca3cb624ab
SHA1 b35514397c0e4da65d8620a3690b59e771242551
SHA512 1b1fe1233116fb14f90093de5ddccbae7bed7ee6ab9064a5579e5d1f81bbe914f0990eaf2fa9984fe6a69376da767f0f61912d7e8a11541ecc1c12763e5c4bc3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/552-130-0x0000000002350000-0x000000000239D000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
552	regsvr32.exe
552	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 552	2388	regsvr32.exe	81
PID 2388 wrote to memory of 552	2388	regsvr32.exe	81
PID 2388 wrote to memory of 552	2388	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12_2022-03-17__171246.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12_2022-03-17__171246.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552

memory/552-130-0x0000000002350000-0x000000000239D000-memory.dmp

Download