emotet | ea76aedb8375d9ff251d9c75ece8e58ec4a9255f529e11a8428cfaacff1fedf6

Analysis

Target
emotet_exe_e4_ea76aedb8375d9ff251d9c75ece8e58ec4a9255f529e11a8428cfaacff1fedf6_2022-03-21__112348.dll
Size 764KB
Sample220321-nhp8csbhfk
SHA256 ea76aedb8375d9ff251d9c75ece8e58ec4a9255f529e11a8428cfaacff1fedf6
MD5 a24f34eadc362015c7bbec569fd44a2b
SHA1 d76627020edeedd686cb55a452fd4b96c64fad2f
SHA512 1479b6f4486f6a2815bb458d34a6eef7eb7ba8308b8e1e3b58bf258158ca46b7c4bdfde8e5e2e53f6d05416ad01b1d27a812a717d50c864ad1cfcf43013b43f5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4236	regsvr32.exe
4236	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4236	4648	regsvr32.exe	84
PID 4648 wrote to memory of 4236	4648	regsvr32.exe	84
PID 4648 wrote to memory of 4236	4648	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ea76aedb8375d9ff251d9c75ece8e58ec4a9255f529e11a8428cfaacff1fedf6_2022-03-21__112348.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ea76aedb8375d9ff251d9c75ece8e58ec4a9255f529e11a8428cfaacff1fedf6_2022-03-21__112348.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236

memory/4236-134-0x0000000002680000-0x00000000026A8000-memory.dmp

Download