emotet | aec14bcb72b5717d69cdaace1b450adfc7b60eb47bdb75cab254c8e8ad4d26f4

Analysis

Target
6c093722fbaae5c7a070e116c6c94603.dll
Size 604KB
Sample220302-3ff91aacbl
SHA256 aec14bcb72b5717d69cdaace1b450adfc7b60eb47bdb75cab254c8e8ad4d26f4
MD5 6c093722fbaae5c7a070e116c6c94603
SHA1 a3b002e027a9bdce602873e30188748df9a94a76
SHA512 231d351c85433e00d850f5dc2041b88e147bc8ee53193a3a56eae0c3b3343162077b77cbf4fbc31425449bfad463925272aa52ee8b976cc159018f22c39ca2e3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1600	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c093722fbaae5c7a070e116c6c94603.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6c093722fbaae5c7a070e116c6c94603.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

memory/1600-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1600-56-0x00000000002C0000-0x00000000002E7000-memory.dmp

Download

memory/1672-54-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download