emotet | 8f70e47c02c278d4c49c7dd8ab5ed6d3a07290d5f4f411949d4ad6cd0c4e14d5

Analysis

Target
bf5ca4b5cf4405f66e939a736a4538db.dll
Size 780KB
Sample220321-j96bfaaffr
SHA256 8f70e47c02c278d4c49c7dd8ab5ed6d3a07290d5f4f411949d4ad6cd0c4e14d5
MD5 bf5ca4b5cf4405f66e939a736a4538db
SHA1 a79d62a3cf1efe312238035413cf4f0f78ed8940
SHA512 14a07ca371f4936b9d60e4a3e5b76b0991a02c3a80c5d80b22cc86a85f97060962cf390b59ccea61de79f21d22fe26b22fe36b1a386e34111372f7da9a7dc69b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
864	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27
PID 1060 wrote to memory of 864	1060	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf5ca4b5cf4405f66e939a736a4538db.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf5ca4b5cf4405f66e939a736a4538db.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864

memory/864-55-0x0000000075691000-0x0000000075693000-memory.dmp

Download

memory/864-56-0x00000000002F0000-0x0000000000317000-memory.dmp

Download

memory/1060-54-0x000007FEFB7A1000-0x000007FEFB7A3000-memory.dmp

Download