emotet | c100b0e4ff719502e05e9d30691b76c75a4c2a790fdda81555fe42a90fd321f5

Analysis

Target
emotet_exe_e5_c100b0e4ff719502e05e9d30691b76c75a4c2a790fdda81555fe42a90fd321f5_2022-03-18__191945.dll
Size 567KB
Sample220318-x149nseabl
SHA256 c100b0e4ff719502e05e9d30691b76c75a4c2a790fdda81555fe42a90fd321f5
MD5 ee3bf4d3ca259822c0b8356f29c080aa
SHA1 a72429ca8ac15d426df86cb862d4d98f2cccfb03
SHA512 2334d1a0c26b87ec6d3632e46651a01a7fa9f5c0b2b6abb9814bcb93e1e4effd190ad4790fe46295c58d5696f38645f2c2d066f6d6b9bd99c8c4a031966f3de6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	regsvr32.exe
2812	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2812	4356	regsvr32.exe	80
PID 4356 wrote to memory of 2812	4356	regsvr32.exe	80
PID 4356 wrote to memory of 2812	4356	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c100b0e4ff719502e05e9d30691b76c75a4c2a790fdda81555fe42a90fd321f5_2022-03-18__191945.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c100b0e4ff719502e05e9d30691b76c75a4c2a790fdda81555fe42a90fd321f5_2022-03-18__191945.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812

memory/2812-130-0x0000000010000000-0x0000000010027000-memory.dmp

Download