emotet | 7e5ff2f7b149ed1417969e4a1e891b915dac5ac58f7e867da5d80ea9eaf0bb87

Analysis

Target
13b259ac4cb03b08fd8a5728257bec28.dll
Size 732KB
Sample220316-1l3dbafbdk
SHA256 7e5ff2f7b149ed1417969e4a1e891b915dac5ac58f7e867da5d80ea9eaf0bb87
MD5 13b259ac4cb03b08fd8a5728257bec28
SHA1 d8ef637a3e2e269c49bea2798c7490b7bfd99e53
SHA512 9e66970125ede04c0d6b4ac0ff2c68924250253586566c1396b14c7eb7d36523503f447f3d1f1a4f5ceef319c23f22c8351f0b5dc056c264ae130eb18f12e179
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4852	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bjrgfanaoooj\idlinem.sfm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	regsvr32.exe
4852	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3148	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3148	3864	regsvr32.exe	82
PID 3864 wrote to memory of 3148	3864	regsvr32.exe	82
PID 3864 wrote to memory of 3148	3864	regsvr32.exe	82
PID 3148 wrote to memory of 4852	3148	regsvr32.exe	85
PID 3148 wrote to memory of 4852	3148	regsvr32.exe	85
PID 3148 wrote to memory of 4852	3148	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13b259ac4cb03b08fd8a5728257bec28.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\13b259ac4cb03b08fd8a5728257bec28.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bjrgfanaoooj\idlinem.sfm"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4852

memory/3148-134-0x0000000000B80000-0x0000000000BB4000-memory.dmp

Download

memory/4852-139-0x0000000002940000-0x0000000002974000-memory.dmp

Download