emotet | c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a

Analysis

Target
emotet_exe_e5_c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a_2022-04-23__210632.dll
Size 660KB
Sample220423-zyandsafdp
SHA256 c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a
MD5 5372b11d40593e38f2102185fcc4c658
SHA1 dd179bf34ed4f6fe793013c13e4b5caeb866d61d
SHA512 138b56c805bfae6deea3126a809117f1beb4932d60d406c48724b5e722388f2280142a902d7f15f52736064fb5ac83acda68cf9b26ca2aeb599e26108c644a16
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1748	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28
PID 1036 wrote to memory of 1748	1036	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a_2022-04-23__210632.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c936ba4d48cc7be323d4c0d2866440f75da152dee0ec2d2ad19f79169deaf28a_2022-04-23__210632.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

memory/1036-54-0x000007FEFB721000-0x000007FEFB723000-memory.dmp

Download

memory/1748-56-0x0000000075B61000-0x0000000075B63000-memory.dmp

Download

memory/1748-58-0x00000000001C0000-0x00000000001E7000-memory.dmp

Download