emotet | 46e777814bfc5ec8244dba6109ac958f36e7cfdefa23daec46ec50bdb55e0a42

Analysis

Target
af243c7c83f0be0551ca5a7a2e26f407.dll
Size 664KB
Sample220316-kywtashhbn
SHA256 46e777814bfc5ec8244dba6109ac958f36e7cfdefa23daec46ec50bdb55e0a42
MD5 af243c7c83f0be0551ca5a7a2e26f407
SHA1 e3654768258475afbde9f8255dede421f0f782be
SHA512 1ed835bc310df9eaedd3e09cb2904999d254949153fc664c22da9085ba9d6e588db769ed7595e1576902ee2a6a12f8cf0f929d407098779c591ec4f0178e7eed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
1244	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kxjcvyr\dezrzujcq.nfm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1244	regsvr32.exe
1244	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3196	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3196	5076	regsvr32.exe	83
PID 5076 wrote to memory of 3196	5076	regsvr32.exe	83
PID 5076 wrote to memory of 3196	5076	regsvr32.exe	83
PID 3196 wrote to memory of 1244	3196	regsvr32.exe	89
PID 3196 wrote to memory of 1244	3196	regsvr32.exe	89
PID 3196 wrote to memory of 1244	3196	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\af243c7c83f0be0551ca5a7a2e26f407.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\af243c7c83f0be0551ca5a7a2e26f407.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kxjcvyr\dezrzujcq.nfm"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1244

memory/1244-139-0x00000000011A0000-0x00000000011D4000-memory.dmp

Download

memory/3196-134-0x0000000000C50000-0x0000000000C84000-memory.dmp

Download