emotet | 15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f

Analysis

Target
emotet_exe_e4_15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f_2022-03-21__103003.dll
Size 585KB
Sample220321-mkdrnsbfcq
SHA256 15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f
MD5 5f2d6217c3d0477eacd905f68748a872
SHA1 1e5965b248a10ff3dcca67e42b3dca8a2483bfd2
SHA512 b624088389eca378f16868778e81169130e94fd466153d6c155d4fd40c41c2624d3b9e8dc9ad3e1226cc6098c39ef833b0b111be62c31c67e910c3bcc95519c4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2816	regsvr32.exe
2816	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2816	2716	regsvr32.exe	80
PID 2716 wrote to memory of 2816	2716	regsvr32.exe	80
PID 2716 wrote to memory of 2816	2716	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f_2022-03-21__103003.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f_2022-03-21__103003.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

memory/2816-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download