emotet | d3ccaa71b0aaa1305a8cd74d8b7bf9087ff50f18e686901a75507308206233df

Analysis

Target
emotet_exe_e5_d3ccaa71b0aaa1305a8cd74d8b7bf9087ff50f18e686901a75507308206233df_2022-03-18__000201.dll
Size 780KB
Sample220318-ab61msfgck
SHA256 d3ccaa71b0aaa1305a8cd74d8b7bf9087ff50f18e686901a75507308206233df
MD5 f995acb442ec17fb393d89cab28af739
SHA1 8b8dec12c14c22e2b95a998121345cf0e0a31a08
SHA512 399bc647bdadf2ebaf2b33ab855aea4f2a554be10e71354adf7f7d4020a856e79c962561cd1045230d5b14520b9b2bef28fc26cf421a225c2312054877faf76d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/1624-134-0x0000000002530000-0x000000000257C000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	regsvr32.exe
1624	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1624	1128	regsvr32.exe	82
PID 1128 wrote to memory of 1624	1128	regsvr32.exe	82
PID 1128 wrote to memory of 1624	1128	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d3ccaa71b0aaa1305a8cd74d8b7bf9087ff50f18e686901a75507308206233df_2022-03-18__000201.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d3ccaa71b0aaa1305a8cd74d8b7bf9087ff50f18e686901a75507308206233df_2022-03-18__000201.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624

memory/1624-134-0x0000000002530000-0x000000000257C000-memory.dmp

Download