emotet | f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8

Analysis

Target
emotet_exe_e4_f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8_2022-03-17__171246.dll
Size 800KB
Sample220317-vreljsdag8
SHA256 f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8
MD5 ae7e95687db3d4733f06047fffebc7a3
SHA1 23e41c5d839c5aa061524dd23f3847176a461506
SHA512 5da90dc7901615743a727ddf4ee82c73aded465e8816fa116d306b4bd9d83f0ebed0f7cc27b3788bd1ce62ae893a3c12a69e2c2d8bcdff5134f3834528b540d9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/1884-130-0x0000000002F50000-0x0000000002F9D000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	regsvr32.exe
1884	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1884	3264	regsvr32.exe	78
PID 3264 wrote to memory of 1884	3264	regsvr32.exe	78
PID 3264 wrote to memory of 1884	3264	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8_2022-03-17__171246.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8_2022-03-17__171246.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

memory/1884-130-0x0000000002F50000-0x0000000002F9D000-memory.dmp

Download