emotet | 9de6e04baa7caef8eabc8e3cfd18c9eb534a2bc1c83b1610fbbfeb035df31185

Analysis

Target
emotet_exe_e5_9de6e04baa7caef8eabc8e3cfd18c9eb534a2bc1c83b1610fbbfeb035df31185_2022-03-18__000159.dll
Size 780KB
Sample220318-abydhafea8
SHA256 9de6e04baa7caef8eabc8e3cfd18c9eb534a2bc1c83b1610fbbfeb035df31185
MD5 41d0b941922e0f4e65a2645e23b9aec7
SHA1 b124198071976b2e8fd78fb44e45d13935d044b2
SHA512 7b230621513d9edc69833dce2df5a6be91b533dfa61d61782cc228b39bb103a3e69bb3ab247c1774507201029ad866b65bbdb943f9baffdc64e9def64f378008
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/2328-134-0x0000000002490000-0x00000000024DC000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	regsvr32.exe
2328	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 2328	3492	regsvr32.exe	82
PID 3492 wrote to memory of 2328	3492	regsvr32.exe	82
PID 3492 wrote to memory of 2328	3492	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9de6e04baa7caef8eabc8e3cfd18c9eb534a2bc1c83b1610fbbfeb035df31185_2022-03-18__000159.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9de6e04baa7caef8eabc8e3cfd18c9eb534a2bc1c83b1610fbbfeb035df31185_2022-03-18__000159.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

memory/2328-134-0x0000000002490000-0x00000000024DC000-memory.dmp

Download