emotet | a4cf86bfc42c90d3aa99a5488b9a00d2b4119820ebea7d36c11124b20cee8096

Analysis

Target
a4cf86bfc42c90d3aa99a5488b9a00d2b4119820ebea7d36c11124b20cee8096.dll
Size 790KB
Sample220308-xd26ssddfk
SHA256 a4cf86bfc42c90d3aa99a5488b9a00d2b4119820ebea7d36c11124b20cee8096
MD5 9529a66c61e9985e66723cd051822d03
SHA1 4e4b0e0218cd715386a318ea1f60c2f24469f262
SHA512 2aacb501f3ffe483d25dc93f1115f81f08afe1c9439f348b5016f0546aed35835dc597f464798804a23ae7770e9b961d7c5e341e3a89026e9994da10a96341ab
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
748	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27
PID 1100 wrote to memory of 748	1100	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a4cf86bfc42c90d3aa99a5488b9a00d2b4119820ebea7d36c11124b20cee8096.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a4cf86bfc42c90d3aa99a5488b9a00d2b4119820ebea7d36c11124b20cee8096.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748

memory/748-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Download

memory/748-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1100-54-0x000007FEFC401000-0x000007FEFC403000-memory.dmp

Download