emotet | da1038e5c0a5c89973b4edbf4517969546efa83be05e8280db83273ed7c87beb

Analysis

Target
emotet_exe_e4_da1038e5c0a5c89973b4edbf4517969546efa83be05e8280db83273ed7c87beb_2022-03-20__000510.dll
Size 585KB
Sample220320-adr99scfhn
SHA256 da1038e5c0a5c89973b4edbf4517969546efa83be05e8280db83273ed7c87beb
MD5 2d45272b8f31d66d30f253ba39b05a22
SHA1 a80bef6714bfcc9dd8e787d2d901e25f405874ae
SHA512 58915bbe3e5ee002e20d4efd29f1580c43444bea60e39406762cd07f560a88eca7bd1e78bc9c679a5717b51c0d5147d6b428e574189a2f86d334f10e117da77f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	regsvr32.exe
1816	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1816	1672	regsvr32.exe	79
PID 1672 wrote to memory of 1816	1672	regsvr32.exe	79
PID 1672 wrote to memory of 1816	1672	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_da1038e5c0a5c89973b4edbf4517969546efa83be05e8280db83273ed7c87beb_2022-03-20__000510.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_da1038e5c0a5c89973b4edbf4517969546efa83be05e8280db83273ed7c87beb_2022-03-20__000510.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

memory/1816-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download