emotet | a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc

Analysis

Target
emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.dll
Size 652KB
Sample220328-ac622aahcl
SHA256 a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc
MD5 9de560ea7997a21a8e715fed48a3cc6c
SHA1 afe3b55bf2e4496900042b4eb6ff3696afbb16b2
SHA512 976064e73e206716cc2a1aa593afac0eb2c0e649d4626c3d46c8cceea4d4cd59c2edfc0728d4420ae664bda6f9505c065bf896ab048e06067211af4efe593ae9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27
PID 1176 wrote to memory of 2000	1176	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

memory/1176-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download

memory/2000-56-0x00000000765D1000-0x00000000765D3000-memory.dmp

Download

memory/2000-57-0x00000000001F0000-0x0000000000214000-memory.dmp

Download