emotet | 720c673091dcf29963336ac2ce31ae53ebd136991ec9b5bc0ec906617b02953e

Analysis

Target
71cee7c073344a2dadbdb13b78c51be8.dll
Size 480KB
Sample220320-2ntdvsgfgq
SHA256 720c673091dcf29963336ac2ce31ae53ebd136991ec9b5bc0ec906617b02953e
MD5 71cee7c073344a2dadbdb13b78c51be8
SHA1 c90dbe8bde2a31e007349054181f3b0a230bac87
SHA512 171182748260ca920de4e082ed1cc75693d0664e1c102a53bd31f9ec765a3ca5505728ece9ebf15e8caa8f9df52b5b9dd116cde5f5af533bb33e1c6447ec1a31
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
856	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27
PID 1676 wrote to memory of 856	1676	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\71cee7c073344a2dadbdb13b78c51be8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\71cee7c073344a2dadbdb13b78c51be8.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

memory/856-55-0x00000000749A1000-0x00000000749A3000-memory.dmp

Download

memory/856-56-0x0000000000340000-0x0000000000367000-memory.dmp

Download

memory/1676-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Download