emotet | dd20054e64e6c8d824827b0c86cfe3d725eff4ef0e3bf3ab57a5c5119df86f11

Analysis

Target
638329065ac481714f4235ec68072798.dll
Size 801KB
Sample220314-pdrq3aghhm
SHA256 dd20054e64e6c8d824827b0c86cfe3d725eff4ef0e3bf3ab57a5c5119df86f11
MD5 638329065ac481714f4235ec68072798
SHA1 1c4f68ff7c7cc8d154f7e507ee68509e121c748c
SHA512 e4869b5ed175099bb345532ca970dc6c8263970e5a79427e346bb56e01160b71a22940f090392f1feaea9270ed81ac34442d80877d3f269f2a0b94917d9992c3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Badqns\olfedbsqxxkphk.bms	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1940	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
964	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 964 wrote to memory of 1940	964	regsvr32.exe	28
PID 964 wrote to memory of 1940	964	regsvr32.exe	28
PID 964 wrote to memory of 1940	964	regsvr32.exe	28
PID 964 wrote to memory of 1940	964	regsvr32.exe	28
PID 964 wrote to memory of 1940	964	regsvr32.exe	28
PID 964 wrote to memory of 1940	964	regsvr32.exe	28
PID 964 wrote to memory of 1940	964	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\638329065ac481714f4235ec68072798.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\638329065ac481714f4235ec68072798.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Badqns\olfedbsqxxkphk.bms"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1940

memory/948-54-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp

Download

memory/964-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Download

memory/964-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download