emotet | 369aec02e656f849c8d73111ca7b673710d1e0d1c779c3c0f622842992e76ed7

Analysis

Target
emotet_exe_e5_369aec02e656f849c8d73111ca7b673710d1e0d1c779c3c0f622842992e76ed7_2022-03-18__000203.dll
Size 780KB
Sample220318-ab7beafeb8
SHA256 369aec02e656f849c8d73111ca7b673710d1e0d1c779c3c0f622842992e76ed7
MD5 eab56f520d65b1509bdd75ed74980cad
SHA1 cddac15bf7b0fcc3cbd939049c6973134ec24e4b
SHA512 185321f38b48bb5d6e7d6023d3ea70c55582b7bedd155500eef85bc06906b37e9cd8da2502899c39f1ba2d36c1f1b52e472d37a4b19558d3e0771f6525867bf9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/3900-130-0x00000000026A0000-0x00000000026EC000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3900	regsvr32.exe
3900	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3900	4560	regsvr32.exe	79
PID 4560 wrote to memory of 3900	4560	regsvr32.exe	79
PID 4560 wrote to memory of 3900	4560	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_369aec02e656f849c8d73111ca7b673710d1e0d1c779c3c0f622842992e76ed7_2022-03-18__000203.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_369aec02e656f849c8d73111ca7b673710d1e0d1c779c3c0f622842992e76ed7_2022-03-18__000203.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900

memory/3900-130-0x00000000026A0000-0x00000000026EC000-memory.dmp

Download