emotet | 2fd68d6a32a197572f80809ef335afa20a64d6ec26891bde6796dddbaadeeb3c

Analysis

Target
4f6b2ac972299b3485dc863155da4852.dll
Size 1.0MB
Sample220224-3llrnsfbbn
SHA256 2fd68d6a32a197572f80809ef335afa20a64d6ec26891bde6796dddbaadeeb3c
MD5 4f6b2ac972299b3485dc863155da4852
SHA1 133c00972fad3bdec31250e76d0c8538f803d0cf
SHA512 3f66f97083e1c9c82d122c137d2ff90c7388f38abe0996203a167ba7ed5e5fb050e8277eb0cbaf31885f788bb1e4f005cc473b2183ac3e37683416c679deb86f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gtyeauclfptjirck\magavhgdsmz.nsz	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1176	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1176	1768	regsvr32.exe	27
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28
PID 1176 wrote to memory of 956	1176	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4f6b2ac972299b3485dc863155da4852.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4f6b2ac972299b3485dc863155da4852.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Gtyeauclfptjirck\magavhgdsmz.nsz"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:956

memory/956-59-0x0000000000960000-0x0000000000985000-memory.dmp

Download

memory/1176-55-0x0000000074BE1000-0x0000000074BE3000-memory.dmp

Download

memory/1176-56-0x0000000000560000-0x0000000000585000-memory.dmp

Download

memory/1768-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download