emotet | 986c6b86363bd3af851e8ede19c08d7428bc32fa06e52a2cac34c1941e1992ba

Analysis

Target
emotet_exe_e5_986c6b86363bd3af851e8ede19c08d7428bc32fa06e52a2cac34c1941e1992ba_2022-03-22__041113.dll
Size 567KB
Sample220322-esjc5aagbm
SHA256 986c6b86363bd3af851e8ede19c08d7428bc32fa06e52a2cac34c1941e1992ba
MD5 d29dabf238fc27f37537587120522b3b
SHA1 f297899efd4bd7f91aa9c71a72199499c469b8d5
SHA512 5d7362cfea1e4c661e1938e389bd97101aac75a5544a48080f82399d49dacfb23502d80c33c9c810653a319378e0427a77ea0fff2b315e38ab7835837e2a9b45
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4180	regsvr32.exe
4180	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4180	5004	regsvr32.exe	83
PID 5004 wrote to memory of 4180	5004	regsvr32.exe	83
PID 5004 wrote to memory of 4180	5004	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_986c6b86363bd3af851e8ede19c08d7428bc32fa06e52a2cac34c1941e1992ba_2022-03-22__041113.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_986c6b86363bd3af851e8ede19c08d7428bc32fa06e52a2cac34c1941e1992ba_2022-03-22__041113.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180

memory/4180-134-0x0000000010000000-0x0000000010027000-memory.dmp

Download