emotet | 51567e4aeb490ba92da206bb96201370a585de0717cc3f8189386c9409380967

Analysis

Target
emotet_exe_e5_51567e4aeb490ba92da206bb96201370a585de0717cc3f8189386c9409380967_2022-03-23__180944.dll
Size 976KB
Sample220323-wr28aaedgp
SHA256 51567e4aeb490ba92da206bb96201370a585de0717cc3f8189386c9409380967
MD5 179d5b8adcc0f4de94dc8d33c3edd776
SHA1 36dac24ad1075c25574b6981d443b42dd2626389
SHA512 7d0ba0bc20ee0c71653ef1da5316849f8487f1e0f1805843315a9587752e46b09f4b72b1ee9c1e65a840f15c04eb590c09a8b855025689056cf026a3e8c2227e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
584	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27
PID 1668 wrote to memory of 584	1668	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_51567e4aeb490ba92da206bb96201370a585de0717cc3f8189386c9409380967_2022-03-23__180944.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_51567e4aeb490ba92da206bb96201370a585de0717cc3f8189386c9409380967_2022-03-23__180944.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584

memory/584-56-0x0000000075E51000-0x0000000075E53000-memory.dmp

Download

memory/584-58-0x00000000001B0000-0x00000000001D3000-memory.dmp

Download

memory/1668-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Download