emotet | dfb1d8689e9277383aab3898cb68e2fbb020be40473b6d832c2df84c136c63e7

Analysis

Target
emotet_exe_e4_dfb1d8689e9277383aab3898cb68e2fbb020be40473b6d832c2df84c136c63e7_2022-03-29__080822.dll
Size 576KB
Sample220329-j15csaghar
SHA256 dfb1d8689e9277383aab3898cb68e2fbb020be40473b6d832c2df84c136c63e7
MD5 a9784e7e0c11074ddc42190292f4ceff
SHA1 da4f7ce50d06298e6db0e46e0420e2ad2c4112c2
SHA512 884f25fe5370cd5c01a09696aa4410fafd2473216e797351ecf505afc364f5d0b91a410d37e79870ce802bd9ad186e79210bf8de2361f424ea973b75235e935c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	regsvr32.exe
3068	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3068	2796	regsvr32.exe	79
PID 2796 wrote to memory of 3068	2796	regsvr32.exe	79
PID 2796 wrote to memory of 3068	2796	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dfb1d8689e9277383aab3898cb68e2fbb020be40473b6d832c2df84c136c63e7_2022-03-29__080822.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dfb1d8689e9277383aab3898cb68e2fbb020be40473b6d832c2df84c136c63e7_2022-03-29__080822.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068

memory/3068-131-0x0000000002A20000-0x0000000002A44000-memory.dmp

Download