emotet | e77e58748274cb5cbbf2fd6cb8a9f59d574649b265e085723274055d181df855

Analysis

Target
a6d658ae932b0e4027bc197ab6a12f15.dll
Size 780KB
Sample220317-244vjaffdk
SHA256 e77e58748274cb5cbbf2fd6cb8a9f59d574649b265e085723274055d181df855
MD5 a6d658ae932b0e4027bc197ab6a12f15
SHA1 f9b81a8297c3083a3259620c3787dcd045f24caa
SHA512 3c2a1af03b5076d4585480d0b4936062b3001f3105f9c511b4eef1fe0d903bf05184e018681dea20d3e7b66fb63a0b827d818195b1b72f108022754aebd1b675
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/3416-134-0x0000000002980000-0x00000000029CC000-memory.dmp	Emotet4
behavioral2/memory/4180-139-0x00000000022B0000-0x00000000022FC000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
4180	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Azcrjdk\beczukfl.xce	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4180	regsvr32.exe
4180	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3416	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3416	3076	regsvr32.exe	82
PID 3076 wrote to memory of 3416	3076	regsvr32.exe	82
PID 3076 wrote to memory of 3416	3076	regsvr32.exe	82
PID 3416 wrote to memory of 4180	3416	regsvr32.exe	90
PID 3416 wrote to memory of 4180	3416	regsvr32.exe	90
PID 3416 wrote to memory of 4180	3416	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a6d658ae932b0e4027bc197ab6a12f15.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a6d658ae932b0e4027bc197ab6a12f15.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Azcrjdk\beczukfl.xce"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4180

memory/3416-134-0x0000000002980000-0x00000000029CC000-memory.dmp

Download

memory/4180-139-0x00000000022B0000-0x00000000022FC000-memory.dmp

Download