emotet | 5e972bce83d9f4492260f157dee45693e90d91657ff7c7c607401756bd30e061

Analysis

Target
5e972bce83d9f4492260f157dee45693e90d91657ff7c7c607401756bd30e061.dll
Size 780KB
Sample220322-relybacbdn
SHA256 5e972bce83d9f4492260f157dee45693e90d91657ff7c7c607401756bd30e061
MD5 69de553df896afcae6c52e1eae23beb3
SHA1 82c28d0b3ad826cc7761d4486e4f7b870b8e9b58
SHA512 2f8659ad905396fa849eaea27fcb55788a367241eb5b46619f772d4401cab3b382c24bd6ccbed5f1d7e3e19e34d772d50ba7e43f0613fa8a285fe19530504174
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e972bce83d9f4492260f157dee45693e90d91657ff7c7c607401756bd30e061.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5e972bce83d9f4492260f157dee45693e90d91657ff7c7c607401756bd30e061.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

memory/1124-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Download

memory/1124-56-0x00000000007B0000-0x00000000007FC000-memory.dmp

Download

memory/1472-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download