emotet | f7bfa7cd4b3d5c346a89a043d2db6be770a752cd258a17b93f181a720f0804b9

Analysis

Target
emotet_exe_e4_f7bfa7cd4b3d5c346a89a043d2db6be770a752cd258a17b93f181a720f0804b9_2022-03-18__000435.dll
Size 538KB
Sample220318-ac794afed9
SHA256 f7bfa7cd4b3d5c346a89a043d2db6be770a752cd258a17b93f181a720f0804b9
MD5 9f5dc758984701d6c5d78f0cefe79294
SHA1 3781b6226fc33ccfa3da8253e7f98633bacec81c
SHA512 96d778dd66c4aa20fd827493ce5fd661e43767b30dffbf6646b4612d13c5a155452e091cdf16e5c37a710d2d50d267f47103b856931067c451e23cdd9689cde7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/884-134-0x0000000010000000-0x0000000010028000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
884	regsvr32.exe
884	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 884	3472	regsvr32.exe	82
PID 3472 wrote to memory of 884	3472	regsvr32.exe	82
PID 3472 wrote to memory of 884	3472	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7bfa7cd4b3d5c346a89a043d2db6be770a752cd258a17b93f181a720f0804b9_2022-03-18__000435.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7bfa7cd4b3d5c346a89a043d2db6be770a752cd258a17b93f181a720f0804b9_2022-03-18__000435.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884

memory/884-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download