emotet | 68f06b4cf69d963da368a05a8f8202a86ffec17e1174569cb74cf89e808844ae

Analysis

Target
2e7fdbc8a4724ff0fdc81242daf4168a.dll
Size 797KB
Sample220307-ldly2afebn
SHA256 68f06b4cf69d963da368a05a8f8202a86ffec17e1174569cb74cf89e808844ae
MD5 2e7fdbc8a4724ff0fdc81242daf4168a
SHA1 b477eab106f8bc362387821ba9e49651e8f011fd
SHA512 5ab9b88ccd8319d5717d70dbfa86650aea220ff13f2906e7eef384ca36ccc2754c77ff6ad218a20ac1bba071e962d806dd5560273a87cf43f5d20c28b668142c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1288	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27
PID 1464 wrote to memory of 1288	1464	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e7fdbc8a4724ff0fdc81242daf4168a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e7fdbc8a4724ff0fdc81242daf4168a.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288

memory/1288-56-0x0000000075F81000-0x0000000075F83000-memory.dmp

Download

memory/1288-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1464-55-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download