emotet | 987707d1948d66108181198f36c9df673d04bb2cdff561c11ff60e31b178f263

Analysis

Target
ab44edd8515ee8245e36ecb95ed6985e.dll
Size 480KB
Sample220320-2ntdvsgfgr
SHA256 987707d1948d66108181198f36c9df673d04bb2cdff561c11ff60e31b178f263
MD5 ab44edd8515ee8245e36ecb95ed6985e
SHA1 cf9b1f4d3e2c0b0139c67dd313cba3871894cdfc
SHA512 441acd9ee3fd59cecb4e7e86df7c20b5956224e9203700b348a5a9d5f2549f8f9b8bbc49ed5e3254383e6774e15c96e4851d7268a9dbc1cd6980fbc9ad6786ce
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1992	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1992	1640	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ab44edd8515ee8245e36ecb95ed6985e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ab44edd8515ee8245e36ecb95ed6985e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992

memory/1640-54-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Download

memory/1992-55-0x0000000075931000-0x0000000075933000-memory.dmp

Download

memory/1992-56-0x0000000000190000-0x00000000001B7000-memory.dmp

Download