emotet | dab4fd0a7e93d460f8961902e12e2734dc089586db0e3b52609375ef951da732

Analysis

Target
dab4fd0a7e93d460f8961902e12e2734dc089586db0e3b52609375ef951da732.dll
Size 1012KB
Sample220322-p9erdabedm
SHA256 dab4fd0a7e93d460f8961902e12e2734dc089586db0e3b52609375ef951da732
MD5 05845db62454ae7137263934fb832d2b
SHA1 2f006ace932c74c4a3de3b44b12b44f46a1462ee
SHA512 518a72e8ac5c497e805d4f34abd8ba7e7c3aa1bb97982a65bf53d3ac2f05f31f096d37cf2adcc82e0ae4c8d8880ce9ba5a93b38577172296f4710a7398291f88
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1676	536	regsvr32.exe	27
PID 536 wrote to memory of 1676	536	regsvr32.exe	27
PID 536 wrote to memory of 1676	536	regsvr32.exe	27
PID 536 wrote to memory of 1676	536	regsvr32.exe	27
PID 536 wrote to memory of 1676	536	regsvr32.exe	27
PID 536 wrote to memory of 1676	536	regsvr32.exe	27
PID 536 wrote to memory of 1676	536	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dab4fd0a7e93d460f8961902e12e2734dc089586db0e3b52609375ef951da732.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dab4fd0a7e93d460f8961902e12e2734dc089586db0e3b52609375ef951da732.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

memory/536-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Download

memory/1676-55-0x00000000749A1000-0x00000000749A3000-memory.dmp

Download

memory/1676-56-0x0000000000290000-0x00000000002B8000-memory.dmp

Download