emotet | 91db477ebd4078f466066d60173620ec44535f06e3396f40ab89bb48326c0fc2

Analysis

Target
66c4a75ae28cf082734e800b88e0fb47.dll
Size 668KB
Sample220315-1ggaaaefdr
SHA256 91db477ebd4078f466066d60173620ec44535f06e3396f40ab89bb48326c0fc2
MD5 66c4a75ae28cf082734e800b88e0fb47
SHA1 1071b1b30d9def9b4a4311be10ceb6ad96871f4a
SHA512 676e364eeb3e47d8475f057a6793950ed94a476ab87a23db71e55f2951c016c32510a65246c2fc41a6124d74e444e31d284b5e9e6c898ac15b5c519cbca2318e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gulho\dspaf.prt	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1804	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1636	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1636	1976	regsvr32.exe	27
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1804	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\66c4a75ae28cf082734e800b88e0fb47.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\66c4a75ae28cf082734e800b88e0fb47.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Gulho\dspaf.prt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1804

memory/1636-55-0x0000000074C61000-0x0000000074C63000-memory.dmp

Download

memory/1636-56-0x0000000000590000-0x00000000005B7000-memory.dmp

Download

memory/1804-60-0x0000000000190000-0x00000000001B7000-memory.dmp

Download

memory/1976-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download