emotet | 408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622

Analysis

Target
emotet_exe_e4_408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622_2022-03-29__121840.dll
Size 584KB
Sample220329-pg6pdshhcj
SHA256 408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622
MD5 9fb73cc398a8408b5565858c2a32063c
SHA1 83454877227459fade6ffa31191916943ea8edfd
SHA512 d1e4f14063acbbd95d163245e2601e55238ee7a778cd2ab14df967e05e621a9d40f3c44e793923db8c842a630fa837f01b6f01d198d70b3a2d23d386e6d581dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2736	regsvr32.exe
2736	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2736	2560	regsvr32.exe	79
PID 2560 wrote to memory of 2736	2560	regsvr32.exe	79
PID 2560 wrote to memory of 2736	2560	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622_2022-03-29__121840.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_408206fb36ef3ef7e56c8ecbb047c4f2e8ff7a30ee9d57ef593ce4cbd691f622_2022-03-29__121840.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

memory/2736-131-0x0000000002D10000-0x0000000002D34000-memory.dmp

Download