emotet | 5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7

Analysis

Target
emotet_exe_e4_5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7_2022-03-29__080823.dll
Size 576KB
Sample220329-j15csaghap
SHA256 5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7
MD5 cab0e24e66486f2f38fc6c84ae670a8d
SHA1 ce179efb5bd6e1e962139385acf6989207fad14b
SHA512 2201e0730c8fa0845dc887f2caf222b09c79efb592de4bcfb1aa4de2777beb6b33e0deb9d4b91062033d807626fcc2b9a770bcdfd1dd2f2b1aa8de8c87947b7e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1084	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27
PID 1068 wrote to memory of 1084	1068	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7_2022-03-29__080823.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5675ee024b4c4d6ed0a8963e1614961c7773c7faed735d24d96351e8201f02c7_2022-03-29__080823.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

memory/1068-54-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Download

memory/1084-56-0x00000000768A1000-0x00000000768A3000-memory.dmp

Download

memory/1084-57-0x0000000000460000-0x0000000000484000-memory.dmp

Download