emotet | f44668570cfdc87c702bde33204ba646f9d384ea5dd02480d05aac69ad133dca

Analysis

Target
6f4ca6e1b082c4fc66a0fe01dacc57dd.dll
Size 796KB
Sample220317-mm9l5abcdm
SHA256 f44668570cfdc87c702bde33204ba646f9d384ea5dd02480d05aac69ad133dca
MD5 6f4ca6e1b082c4fc66a0fe01dacc57dd
SHA1 16c3c7252d95b4f4764c892358c06637339c8e13
SHA512 a4496dfec2e82594b215a2dbf91231ea582ace713571ddf44e5298b7e3b7d0cabee83d50c4a272548f25588a52ede0e87e516f4ddc53ccc4eb7e39a712cedd6e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
2024	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ihxihyfbkvo\hsqnmqnz.liy	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	regsvr32.exe
2024	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
924	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 924	4792	regsvr32.exe	84
PID 4792 wrote to memory of 924	4792	regsvr32.exe	84
PID 4792 wrote to memory of 924	4792	regsvr32.exe	84
PID 924 wrote to memory of 2024	924	regsvr32.exe	85
PID 924 wrote to memory of 2024	924	regsvr32.exe	85
PID 924 wrote to memory of 2024	924	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6f4ca6e1b082c4fc66a0fe01dacc57dd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6f4ca6e1b082c4fc66a0fe01dacc57dd.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ihxihyfbkvo\hsqnmqnz.liy"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2024

memory/924-134-0x0000000000C90000-0x0000000000CDD000-memory.dmp

Download

memory/2024-139-0x0000000002560000-0x00000000025AD000-memory.dmp

Download