emotet | 8dae73b2310748a85e356519fbb57a1deba40dcbd80dc94687d6810ac703fbd2

Analysis

Target
3b542436bde04194f58b379a34759597.dll
Size 732KB
Sample220317-mm9l5abcdl
SHA256 8dae73b2310748a85e356519fbb57a1deba40dcbd80dc94687d6810ac703fbd2
MD5 3b542436bde04194f58b379a34759597
SHA1 b2fd6795c385cd49acdb37b39e7d6d724430b63d
SHA512 75b95cc2614a779a80714cd895e169c9b34c8c7ba48c3a726628d5a4da43e658597684d04333ff65a631f70bae0e693cd20a50d0f1ab11e06420d16f5bd456da
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
2096	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Sinap\pkxuchuraspyncl.qvf	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2096	regsvr32.exe
2096	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1752	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1752	2004	regsvr32.exe	82
PID 2004 wrote to memory of 1752	2004	regsvr32.exe	82
PID 2004 wrote to memory of 1752	2004	regsvr32.exe	82
PID 1752 wrote to memory of 2096	1752	regsvr32.exe	87
PID 1752 wrote to memory of 2096	1752	regsvr32.exe	87
PID 1752 wrote to memory of 2096	1752	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b542436bde04194f58b379a34759597.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b542436bde04194f58b379a34759597.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Sinap\pkxuchuraspyncl.qvf"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2096

memory/1752-134-0x0000000000910000-0x0000000000944000-memory.dmp

Download

memory/2096-139-0x0000000002840000-0x0000000002874000-memory.dmp

Download