emotet | edc6a78376e18e844f801d05330c01055076ff648fb9cbd243d7ce99c9c7339f

Analysis

Target
ef863f27565df764c76d602ddee646f0.dll
Size 664KB
Sample220316-vd25padeeq
SHA256 edc6a78376e18e844f801d05330c01055076ff648fb9cbd243d7ce99c9c7339f
MD5 ef863f27565df764c76d602ddee646f0
SHA1 8fd590db1cb29056b86f25094e60ec1a7be80c6f
SHA512 24f0dde8eb7d74a704357b99ac7e09627bb258c0abe799c2498628391b8ac3e97963d3662ac7277141248191ec795b3c197b01901a885bfa6f2bf0ca297afd05
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
3832	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lxaptzudg\czjv.mkv	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3832	regsvr32.exe
3832	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5116	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 5116	3700	regsvr32.exe	82
PID 3700 wrote to memory of 5116	3700	regsvr32.exe	82
PID 3700 wrote to memory of 5116	3700	regsvr32.exe	82
PID 5116 wrote to memory of 3832	5116	regsvr32.exe	88
PID 5116 wrote to memory of 3832	5116	regsvr32.exe	88
PID 5116 wrote to memory of 3832	5116	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef863f27565df764c76d602ddee646f0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ef863f27565df764c76d602ddee646f0.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Lxaptzudg\czjv.mkv"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3832

memory/3832-139-0x00000000007C0000-0x00000000007F4000-memory.dmp

Download

memory/5116-134-0x0000000000D80000-0x0000000000DB4000-memory.dmp

Download