emotet | f82a02c5d3c869301bed36d1424a673a047123e4870dc8a51f45882a8d834888

Analysis

Target
emotet_exe_e5_f82a02c5d3c869301bed36d1424a673a047123e4870dc8a51f45882a8d834888_2022-03-18__000158.dll
Size 780KB
Sample220318-ab61msfeb5
SHA256 f82a02c5d3c869301bed36d1424a673a047123e4870dc8a51f45882a8d834888
MD5 6b3428dd0b2bd4fbd0f4955eae5ad219
SHA1 c41d7318f93ebafdd15c2dd4a5c4548d99a6b6db
SHA512 eb0318fb9c6929d5a7eb9a326ab764d5361fc5740b73209dc1a96efcfd9c49ec99225b93b6d768cae09f86bb0a83f79c3748876dc987b7b1ca3dcbe67a16df61
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/432-134-0x0000000000D30000-0x0000000000D7C000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	regsvr32.exe
432	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 432	4144	regsvr32.exe	82
PID 4144 wrote to memory of 432	4144	regsvr32.exe	82
PID 4144 wrote to memory of 432	4144	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f82a02c5d3c869301bed36d1424a673a047123e4870dc8a51f45882a8d834888_2022-03-18__000158.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f82a02c5d3c869301bed36d1424a673a047123e4870dc8a51f45882a8d834888_2022-03-18__000158.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432

memory/432-134-0x0000000000D30000-0x0000000000D7C000-memory.dmp

Download