emotet | d6ccc4abc521f0ada366e64ba0ad3c9306329d33f31aee123e1c1bff8603cfc1

Analysis

Target
4XssSexsjiBr2oq.dll
Size 801KB
Sample220314-mevs1agbdq
SHA256 d6ccc4abc521f0ada366e64ba0ad3c9306329d33f31aee123e1c1bff8603cfc1
MD5 61ab8a94e2bd5d56db63e54c27cb9459
SHA1 c5f40788779d09818021bba78da65ce1f711ab4e
SHA512 a36fae66e5a9398e10507b482336e52e1fb96e71d2d31cebfedd27e4596a081c5b64b513bb3f7daea6259bbc7da53fd539613582e7bb525f0359dca2b75ab776
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Yvtcsa\kburgrzdhj.new	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 1824 wrote to memory of 2020	1824	regsvr32.exe	27
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28
PID 2020 wrote to memory of 2036	2020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4XssSexsjiBr2oq.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4XssSexsjiBr2oq.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Yvtcsa\kburgrzdhj.new"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036

memory/1824-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/2020-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Download

memory/2020-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download