emotet | 461eb4b1c0810c43a9d096fa3cbd3441c918ca5cf0e455d07c436c3c7a2b2cbc

Analysis

Target
edf57b0bf05feea2df19020bd6766978.dll
Size 572KB
Sample220301-m3d56abcfn
SHA256 461eb4b1c0810c43a9d096fa3cbd3441c918ca5cf0e455d07c436c3c7a2b2cbc
MD5 edf57b0bf05feea2df19020bd6766978
SHA1 e36a4f668134d0a4d5a526082775c12d5f7cad50
SHA512 03298946a8b7930f62bd5c37a021fe3a749d5fdedef5ef2a188720dcffeb6c23cc9a7ef992649f43f85e061447f6caf24e72fdc89cb5e6c7ce8d0c0ec6f434b1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1548	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1548	1624	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\edf57b0bf05feea2df19020bd6766978.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\edf57b0bf05feea2df19020bd6766978.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

memory/1548-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1548-57-0x0000000000230000-0x0000000000257000-memory.dmp

Download

memory/1624-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download