emotet | 41747893f90cbcec3cbc2057d995d18e062a7f72ab220bd4e229550348102008

Analysis

Target
add67a934288c514904965699e127207.dll
Size 924KB
Sample220225-2mnf8aafbk
SHA256 41747893f90cbcec3cbc2057d995d18e062a7f72ab220bd4e229550348102008
MD5 add67a934288c514904965699e127207
SHA1 f77b1f408fd381b2865e9f0176f76189b197af83
SHA512 2f46c4c1091efd64724d62445164fc42f641eedc8a0b2743d23e6600de4ec7bbd905a2c041ff419810d7fd8cfb6ddfbd576f70394f0b9c9980e5758b6dc7479d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1212	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\add67a934288c514904965699e127207.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\add67a934288c514904965699e127207.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212

memory/1212-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1212-56-0x0000000000370000-0x0000000000397000-memory.dmp

Download

memory/1636-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download