emotet | 0b97c437a74bd497d4d4ef4edc1e2b312206dccbd79714c0a13985b579b5646a

Analysis

Target
emotet_exe_e5_0b97c437a74bd497d4d4ef4edc1e2b312206dccbd79714c0a13985b579b5646a_2022-03-18__000158.dll
Size 780KB
Sample220318-ab61msfeb7
SHA256 0b97c437a74bd497d4d4ef4edc1e2b312206dccbd79714c0a13985b579b5646a
MD5 496f8657945dfa5e30f8f5a0c74b382a
SHA1 02c68a0fb862c112b00315d58d67ae82f6514584
SHA512 c8198082fd56e5da35cfcde6fb9dc7393933321af245aa2e502f47a9fde2df0028801919b96eeceaff21a733fa0ac904f47c2d85791746f7b1357c7559609f2b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/5036-134-0x0000000002300000-0x000000000234C000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5036	regsvr32.exe
5036	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5036	4720	regsvr32.exe	82
PID 4720 wrote to memory of 5036	4720	regsvr32.exe	82
PID 4720 wrote to memory of 5036	4720	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0b97c437a74bd497d4d4ef4edc1e2b312206dccbd79714c0a13985b579b5646a_2022-03-18__000158.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0b97c437a74bd497d4d4ef4edc1e2b312206dccbd79714c0a13985b579b5646a_2022-03-18__000158.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036

memory/5036-134-0x0000000002300000-0x000000000234C000-memory.dmp

Download