emotet | 5e4e5bc5b997f69e07b9cf4c8a43d10bb7bb848f72fb807b217e6cee9ea30189

Analysis

Target
85d84207b037582fe0826ca1d4873a57.dll
Size 684KB
Sample220311-1dl2csedgn
SHA256 5e4e5bc5b997f69e07b9cf4c8a43d10bb7bb848f72fb807b217e6cee9ea30189
MD5 85d84207b037582fe0826ca1d4873a57
SHA1 42ae909ebdf12740202d2540e9dd4b1e411b6adb
SHA512 98953752f03cf9b4a2d707e89536bad6d476c5e64a8f2b46240e21257b4e79907a85db2bfce2aa35165373d87b4667de7a29d4286000e727666638b3329a95b6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cwxbtqdfdgzxjzvh\syrfvxyaehfn.iyn	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1656	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1676	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1420 wrote to memory of 1676	1420	regsvr32.exe	27
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28
PID 1676 wrote to memory of 1656	1676	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\85d84207b037582fe0826ca1d4873a57.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\85d84207b037582fe0826ca1d4873a57.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Cwxbtqdfdgzxjzvh\syrfvxyaehfn.iyn"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1656

memory/1420-54-0x000007FEFC121000-0x000007FEFC123000-memory.dmp

Download

memory/1656-60-0x0000000000930000-0x0000000000957000-memory.dmp

Download

memory/1676-55-0x0000000075A31000-0x0000000075A33000-memory.dmp

Download

memory/1676-56-0x00000000009A0000-0x00000000009C7000-memory.dmp

Download