emotet | aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751

Analysis

Target
emotet_exe_e4_aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751_2022-03-28__000417.dll
Size 652KB
Sample220328-ac622aahcj
SHA256 aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751
MD5 038bbd990bae0dba427ff1208b2b72b3
SHA1 a48103f575528af085b79fe36072a81c12777db1
SHA512 e24528944645fbb1667c3aaad41966b98ef12ed0ce560333290f49156176f4d6534bad8bf63eec0705b65efb11a528886feaa7dff675e4eafc50acd69a07fba0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4332	regsvr32.exe
4332	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4332	4340	regsvr32.exe	79
PID 4340 wrote to memory of 4332	4340	regsvr32.exe	79
PID 4340 wrote to memory of 4332	4340	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751_2022-03-28__000417.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751_2022-03-28__000417.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

memory/4332-131-0x0000000002A20000-0x0000000002A44000-memory.dmp

Download