emotet | 79cf8a0d35811ff362c060abdac861ad2bf53e375a612e4af7f45172814b1f02

Analysis

Target
emotet_exe_e5_79cf8a0d35811ff362c060abdac861ad2bf53e375a612e4af7f45172814b1f02_2022-03-25__000512.dll
Size 608KB
Sample220325-adthbsddgj
SHA256 79cf8a0d35811ff362c060abdac861ad2bf53e375a612e4af7f45172814b1f02
MD5 c73a7f08c24c26110f2517da8849e960
SHA1 d1b3b1b64fc7c3d11cbb357d93393717121b5b36
SHA512 6bf1262d6250b1ceace71e9534817a60aac03c3af0e2246fae3cddef6b348b91df2f597aac8f46fbfad63545cceda18522002402c045a7fc30f9e6c4309d29a8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	regsvr32.exe
2744	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2744	2620	regsvr32.exe	80
PID 2620 wrote to memory of 2744	2620	regsvr32.exe	80
PID 2620 wrote to memory of 2744	2620	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_79cf8a0d35811ff362c060abdac861ad2bf53e375a612e4af7f45172814b1f02_2022-03-25__000512.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_79cf8a0d35811ff362c060abdac861ad2bf53e375a612e4af7f45172814b1f02_2022-03-25__000512.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

memory/2744-131-0x0000000002BA0000-0x0000000002BC3000-memory.dmp

Download