emotet | 687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243

Analysis

Target
emotet_exe_e4_687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243_2022-03-28__000417.dll
Size 652KB
Sample220328-ac622aahck
SHA256 687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243
MD5 e009a6373254827762f62c057e075674
SHA1 3504a89c8e639ed2aaa2d94072cb9236dbad6e94
SHA512 2ac991602d2c6477eb8493d54815e3117a315ee6a3148322d81a6c9403dc14299ce360c5d89f4e8f657d69c196d47aac2b625dd00865776079216b303eb0f9c0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
364	regsvr32.exe
364	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 364	2824	regsvr32.exe	83
PID 2824 wrote to memory of 364	2824	regsvr32.exe	83
PID 2824 wrote to memory of 364	2824	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243_2022-03-28__000417.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243_2022-03-28__000417.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364

memory/364-135-0x00000000023C0000-0x00000000023E4000-memory.dmp

Download