emotet | 611ff609b34b53ae5744ec6f9e8055e398375e228f3fca00a87b6d53db564623

Analysis

Target
a735dc9b5ec33e2443f8dfa9a474fd10.dll
Size 668KB
Sample220315-y4zn2adhhr
SHA256 611ff609b34b53ae5744ec6f9e8055e398375e228f3fca00a87b6d53db564623
MD5 a735dc9b5ec33e2443f8dfa9a474fd10
SHA1 2990ac090cd3590d8018adf6884e803aa521c705
SHA512 08c2f9bec3192c7c1a6fb096bf8c0e567b6e99b87cb13e9aa1e6ea092d5f0266399612f8abac587b2c0bddd8b7e4dca769f6ae8f5b7305b9def08600252abefb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
5040	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ycdyovd\llkcwwxjngcvefj.vcv	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5040	regsvr32.exe
5040	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3916	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3916	3400	regsvr32.exe	82
PID 3400 wrote to memory of 3916	3400	regsvr32.exe	82
PID 3400 wrote to memory of 3916	3400	regsvr32.exe	82
PID 3916 wrote to memory of 5040	3916	regsvr32.exe	88
PID 3916 wrote to memory of 5040	3916	regsvr32.exe	88
PID 3916 wrote to memory of 5040	3916	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a735dc9b5ec33e2443f8dfa9a474fd10.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a735dc9b5ec33e2443f8dfa9a474fd10.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ycdyovd\llkcwwxjngcvefj.vcv"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5040

memory/3916-134-0x0000000002890000-0x00000000028B7000-memory.dmp

Download

memory/5040-138-0x00000000026C0000-0x00000000026E7000-memory.dmp

Download