emotet | fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce

Analysis

Target
emotet_exe_e4_fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce_2022-03-26__000112.dll
Size 640KB
Sample220326-abhcaaafgq
SHA256 fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce
MD5 e06f30bbee50eddd65a8b09b6c8847ca
SHA1 8b3d54f19bb8c4522fb770ff953d3fdfebca00b9
SHA512 3256234d70126e732cced8771dfebd3054d8dccfcf991929dae237f379683546c90c5c955138121b7734405f0e52a368d19c54bce3be28ac928070d423cae2fa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1220	regsvr32.exe
1220	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1220	3868	regsvr32.exe	80
PID 3868 wrote to memory of 1220	3868	regsvr32.exe	80
PID 3868 wrote to memory of 1220	3868	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce_2022-03-26__000112.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fc3c67181fc0d5a7374a38120e68a1ff20acc43c3b3f9912814782345fcf99ce_2022-03-26__000112.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

memory/1220-132-0x0000000002C60000-0x0000000002C84000-memory.dmp

Download