emotet | d418996362137d2e905b20d84bfea12edf2aebf2414c2ed2e7d53a0cd9a65b99

Analysis

Target
3d45fbe120cd01197d051a3c454327fd.dll
Size 780KB
Sample220321-kl179aaghq
SHA256 d418996362137d2e905b20d84bfea12edf2aebf2414c2ed2e7d53a0cd9a65b99
MD5 3d45fbe120cd01197d051a3c454327fd
SHA1 7e157a365d28aad7a3a8387f3d07c970c6e8991c
SHA512 a394ecd1a31439bbea04349b33ab7456dcd7da118ddf9e4c80357f0d632bb7148edd5b9709292229e0b495325f7e11d38c0de8d36ae8a5997026b263c187d88b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
596	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 596	360	regsvr32.exe	27
PID 360 wrote to memory of 596	360	regsvr32.exe	27
PID 360 wrote to memory of 596	360	regsvr32.exe	27
PID 360 wrote to memory of 596	360	regsvr32.exe	27
PID 360 wrote to memory of 596	360	regsvr32.exe	27
PID 360 wrote to memory of 596	360	regsvr32.exe	27
PID 360 wrote to memory of 596	360	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d45fbe120cd01197d051a3c454327fd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3d45fbe120cd01197d051a3c454327fd.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:596

memory/360-54-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Download

memory/596-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Download

memory/596-56-0x0000000000330000-0x0000000000357000-memory.dmp

Download