emotet | b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7

Analysis

Target
emotet_exe_e4_b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7_2022-03-29__080823.dll
Size 576KB
Sample220329-j15csaghbk
SHA256 b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7
MD5 34f7aed998768c0c7e79b9cb297b5fb8
SHA1 05fd97c489cf69e7f696c7103bb63bfdd7e703a9
SHA512 8b4b169a55798b6edeff20dd46e5c34e5c790f2209e1c74f6689a705b853208e6683fcc3bcc6078b5c5cd19dd83666afd9d1683447269efaa9116707f1ac7da8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	regsvr32.exe
2032	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2032	1660	regsvr32.exe	80
PID 1660 wrote to memory of 2032	1660	regsvr32.exe	80
PID 1660 wrote to memory of 2032	1660	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7_2022-03-29__080823.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b47dc38b925e7da33666145cf681ec60c98261866596ce24b2de5aa5e79d15e7_2022-03-29__080823.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

memory/2032-131-0x0000000002AD0000-0x0000000002AF4000-memory.dmp

Download