Emotet Moves to 64 bit and Updates its Loader
Tags
attack-pattern: Data Botnet - T1583.005 Botnet - T1584.005 Malware - T1587.001 Malware - T1588.001 Regsvr32 - T1218.010 Rundll32 - T1218.011 Software - T1592.002 Regsvr32 - T1117 Rundll32 - T1085
Show in Graph
Common Information
Type Value
UUID c0a4f4f2-887a-4bd4-b0fb-69a5fb428162
Fingerprint bc145ad1c0270b85
Analysis status DONE
Considered CTI value 2
Text language
Published June 2, 2022, midnight
Added to db Sept. 26, 2022, 9:33 a.m.
Last updated Nov. 18, 2024, 9:32 a.m.
Headline Emotet Moves to 64 bit and Updates its Loader
Title Emotet Moves to 64 bit and Updates its Loader
Detected Hints/Tags/Attributes 32/1/10
Source URLs
Redirection Url
Details Source https://blogs.vmware.com/security/2022/05/emotet-moves-to-64-bit-and-updates-its-loader.html
URL Provider
Details Provider Source level domain
Details vmware.com blogs.vmware.com
Attributes
Details Type #Events CTI Value
Details Domain 1373 
twitter.com
Details File 1019 
rundll32.exe
Details File 7 
regsvr32.dll
Details File 52 
bcrypt.dll
Details File 146 
wininet.dll
Details sha1 3 
e597f6439a01aad82e153e0de647f54ad82b58d3
Details sha1 1 
c6fe1cf52c7f3299f07a1e1c05e19e2013330e4c
Details sha1 2 
7d3f067f4b135a4a4d4b717bc7f7f4dd8e3a7ff8
Details sha1 3 
3c729151d9d2d326a4a3772ee18a1c0ca5db55ce
Details Url 1 
https://twitter.com/cryptolaemus1/status/1516261512372965383.