emotet | c816efc317faa29b24aafcadd89a6aa0d19da35be8bcf56b96f120fba489d29e

Analysis

Target
983270e2a2d98674dc79bb284ad3d40f.dll
Size 684KB
Sample220312-hvephacecm
SHA256 c816efc317faa29b24aafcadd89a6aa0d19da35be8bcf56b96f120fba489d29e
MD5 983270e2a2d98674dc79bb284ad3d40f
SHA1 4ba3ceb36b3456d46f248b22c414438749c1e5ae
SHA512 0da0d2a3f19efb9bf2b574552a048158c646a8f165628c661ae88f002dcedd866a6bf2c113ccfb781710074da594990cea507eee2f39ad39c504d577125fdb9c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Isledexclrgbvan\bxurtsu.dhm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1212	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1684	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1684	1760	regsvr32.exe	27
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1212	1684	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\983270e2a2d98674dc79bb284ad3d40f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\983270e2a2d98674dc79bb284ad3d40f.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Isledexclrgbvan\bxurtsu.dhm"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1212

memory/1212-61-0x00000000001D0000-0x00000000001F7000-memory.dmp

Download

memory/1684-55-0x00000000761D1000-0x00000000761D3000-memory.dmp

Download

memory/1684-57-0x00000000001C0000-0x00000000001E7000-memory.dmp

Download

memory/1760-54-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Download