emotet | cf800e511e8ce96792c6f5f7c4b9f4a71ec48184ee7bdad4629d513c8ff35243

Analysis

Target
696407b3abb67befe10670d4cf52bb1a.dll
Size 494KB
Sample220322-ff96raagdk
SHA256 cf800e511e8ce96792c6f5f7c4b9f4a71ec48184ee7bdad4629d513c8ff35243
MD5 696407b3abb67befe10670d4cf52bb1a
SHA1 bc5fc546bb4710e4ecdf143ac8a0912fb65d938b
SHA512 331779c5a0c079efe7ef0b0059dd6c970f6881e4e7646363498f3f5eaf050b9c183a3e7c8c28f5f467240278445772cacc262eb7d544552be7d48fe63d255d1f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1816	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\696407b3abb67befe10670d4cf52bb1a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\696407b3abb67befe10670d4cf52bb1a.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

memory/1816-55-0x0000000075081000-0x0000000075083000-memory.dmp

Download

memory/1816-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1980-54-0x000007FEFB551000-0x000007FEFB553000-memory.dmp

Download