emotet | 55137d30c6e8639f33bf54c954069dcdd82d4e2e22b183f70f941c129d173905

Analysis

Target
61e4795a9847bb4d1e9dd69c642708f2.dll
Size 494KB
Sample220302-chal5adgdn
SHA256 55137d30c6e8639f33bf54c954069dcdd82d4e2e22b183f70f941c129d173905
MD5 61e4795a9847bb4d1e9dd69c642708f2
SHA1 ccd76ee7062906b0e9e61dba603c30192df7634e
SHA512 ec048a022278ba0996f3092882653c2142747a4b4cf76a29c01e7fdfb58f3253e66a8301f2499bcde161bb0bcfa1c3f9b74cffc1c955ad9870009d4de487090f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Sljteqto\shrqssjqybjvzn.tqt	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
552	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1076	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 960 wrote to memory of 1076	960	regsvr32.exe	27
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28
PID 1076 wrote to memory of 552	1076	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61e4795a9847bb4d1e9dd69c642708f2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61e4795a9847bb4d1e9dd69c642708f2.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Sljteqto\shrqssjqybjvzn.tqt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:552

memory/960-54-0x000007FEFBD31000-0x000007FEFBD33000-memory.dmp

Download

memory/1076-55-0x0000000075131000-0x0000000075133000-memory.dmp

Download

memory/1076-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download