emotet | 3bb2f78609b8a6f151f22b76f4e000c2f7f7dccad99e369d1c4e5caba445b66e

Analysis

Target
f6a2a174a679d66c2aa6cc6fddee1cff.dll
Size 736KB
Sample220316-w8xdcsdhdp
SHA256 3bb2f78609b8a6f151f22b76f4e000c2f7f7dccad99e369d1c4e5caba445b66e
MD5 f6a2a174a679d66c2aa6cc6fddee1cff
SHA1 d171200b1a980089e09e33fa03cb902d2bbaf155
SHA512 a52977a3ee5566c5c036b4822a5f77e0aa2daed0729aa42102f3becd339ba1cf006327a095ba4b8178cea83ce946b1220752fb5660d3c579341ea9da8b50882a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4844	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ddiadi\jztztjir.nog	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	regsvr32.exe
4844	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4656	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4656	3524	regsvr32.exe	82
PID 3524 wrote to memory of 4656	3524	regsvr32.exe	82
PID 3524 wrote to memory of 4656	3524	regsvr32.exe	82
PID 4656 wrote to memory of 4844	4656	regsvr32.exe	85
PID 4656 wrote to memory of 4844	4656	regsvr32.exe	85
PID 4656 wrote to memory of 4844	4656	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f6a2a174a679d66c2aa6cc6fddee1cff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f6a2a174a679d66c2aa6cc6fddee1cff.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ddiadi\jztztjir.nog"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4844

memory/4656-134-0x00000000021B0000-0x00000000021E5000-memory.dmp

Download

memory/4844-139-0x0000000002310000-0x0000000002345000-memory.dmp

Download