emotet | 8dd42bae44b81a33bfe39deccb2fb33faef0d350feb33f826117dedbf1605d5b

Analysis

Target
543176db3e2a3e0a20282118eb4ca877.dll
Size 780KB
Sample220321-kl179aaghp
SHA256 8dd42bae44b81a33bfe39deccb2fb33faef0d350feb33f826117dedbf1605d5b
MD5 543176db3e2a3e0a20282118eb4ca877
SHA1 70f56791a6749f3f48427bd0f2c9ffb334e61e7d
SHA512 399669288b5b09de8d5cc44d15aa972595f7a276f99d94270bc545fe731c16eff93a83792369a77ce5d83a3add2b220e35d5ebb284be91177807926ea01d0f49
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
452	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27
PID 1608 wrote to memory of 452	1608	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\543176db3e2a3e0a20282118eb4ca877.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\543176db3e2a3e0a20282118eb4ca877.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452

memory/452-55-0x0000000075421000-0x0000000075423000-memory.dmp

Download

memory/452-56-0x0000000000300000-0x0000000000327000-memory.dmp

Download

memory/1608-54-0x000007FEFB581000-0x000007FEFB583000-memory.dmp

Download