emotet | 08dad28b6d605a2f73456440bdb278c5d32dff51c0ca8156f8641aadbdfe66da

Analysis

Target
emotet_exe_e4_08dad28b6d605a2f73456440bdb278c5d32dff51c0ca8156f8641aadbdfe66da_2022-03-18__000900.dll
Size 504KB
Sample220318-afmgssfef3
SHA256 08dad28b6d605a2f73456440bdb278c5d32dff51c0ca8156f8641aadbdfe66da
MD5 f8ad57c8ce66862fd9df75d5feae1e34
SHA1 f19d8ee4510007a29b65f48e6b97f055378d4164
SHA512 bb926a050f1342fd171e36828f285dc0b2bdfa03bed2c3b73ec17fd57541d232db3a908a1342cb681c494f015cf462b020a0e6c71857f732e75c9a8a6a5ef4cb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral2/memory/1460-130-0x0000000002A20000-0x0000000002A48000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	regsvr32.exe
1460	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1460	1288	regsvr32.exe	80
PID 1288 wrote to memory of 1460	1288	regsvr32.exe	80
PID 1288 wrote to memory of 1460	1288	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_08dad28b6d605a2f73456440bdb278c5d32dff51c0ca8156f8641aadbdfe66da_2022-03-18__000900.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_08dad28b6d605a2f73456440bdb278c5d32dff51c0ca8156f8641aadbdfe66da_2022-03-18__000900.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

memory/1460-130-0x0000000002A20000-0x0000000002A48000-memory.dmp

Download