emotet | a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc

Analysis

Target
emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.dll
Size 652KB
Sample220328-ac622aahcl
SHA256 a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc
MD5 9de560ea7997a21a8e715fed48a3cc6c
SHA1 afe3b55bf2e4496900042b4eb6ff3696afbb16b2
SHA512 976064e73e206716cc2a1aa593afac0eb2c0e649d4626c3d46c8cceea4d4cd59c2edfc0728d4420ae664bda6f9505c065bf896ab048e06067211af4efe593ae9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	regsvr32.exe
2132	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2132	3300	regsvr32.exe	79
PID 3300 wrote to memory of 2132	3300	regsvr32.exe	79
PID 3300 wrote to memory of 2132	3300	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

memory/2132-134-0x0000000002C50000-0x0000000002C74000-memory.dmp

Download