emotet | 73f44f94be1ce374a50040a9dfbfd33f63cc03b93bb79844a7c1459fd6e2cbed

Analysis

Target
5f51f579d81f05c9ad9a8347bcb0b15c.dll
Size 480KB
Sample220321-av8ctaghak
SHA256 73f44f94be1ce374a50040a9dfbfd33f63cc03b93bb79844a7c1459fd6e2cbed
MD5 5f51f579d81f05c9ad9a8347bcb0b15c
SHA1 3e547f625bba5db872c94737f0d8ab2e8bac56b6
SHA512 65daf2b3ed24ff982bddcaca861be8224490ac68374dd248c74dad72241a439a5bc2d629646aeed245608eb4228e82e7dbaad04ad9bc04e5fa81f2279e2b8e46
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27
PID 1996 wrote to memory of 1964	1996	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5f51f579d81f05c9ad9a8347bcb0b15c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5f51f579d81f05c9ad9a8347bcb0b15c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

memory/1964-55-0x0000000075041000-0x0000000075043000-memory.dmp

Download

memory/1964-56-0x0000000000740000-0x0000000000767000-memory.dmp

Download

memory/1996-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Download