emotet | b7df0364b67bac2efe79202af14e7780ec597e9792fabc56715f02073c86ecb1

Analysis

Target
emotet_exe_e4_b7df0364b67bac2efe79202af14e7780ec597e9792fabc56715f02073c86ecb1_2022-03-18__000900.dll
Size 504KB
Sample220318-afmskafef5
SHA256 b7df0364b67bac2efe79202af14e7780ec597e9792fabc56715f02073c86ecb1
MD5 4adccd635f9d97328c8dcdee282243de
SHA1 a686034648cae377a02ca746c7f2226ae5a3288b
SHA512 f99c9c3be031358066d597c21c6406e0968079be14e9755ba8368f7a35c7fddbe40b35c66ee3286278548f4aaf7d2920d2e957c7725a600eb4c3775fe8471afc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 1 IoCs

resource	yara_rule
behavioral1/memory/1728-56-0x0000000000160000-0x0000000000188000-memory.dmp	Emotet4

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1728	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1728	1724	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b7df0364b67bac2efe79202af14e7780ec597e9792fabc56715f02073c86ecb1_2022-03-18__000900.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b7df0364b67bac2efe79202af14e7780ec597e9792fabc56715f02073c86ecb1_2022-03-18__000900.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

memory/1724-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Download

memory/1728-55-0x0000000075441000-0x0000000075443000-memory.dmp

Download

memory/1728-56-0x0000000000160000-0x0000000000188000-memory.dmp

Download