emotet | ce24bbcefda31d9944a308ab7148bee300758f939f5b5bc00ea7cc6fbc306a54

Analysis

Target
ce24bbcefda31d9944a308ab7148bee300758f939f5b5bc00ea7cc6fbc306a54.dll
Size 780KB
Sample220322-rs8n8scdaq
SHA256 ce24bbcefda31d9944a308ab7148bee300758f939f5b5bc00ea7cc6fbc306a54
MD5 4b12d4ee5f977892b031e530532077c5
SHA1 5e76263e57b39b447692a461131f36dfce475b0d
SHA512 60860c3c1feb77e59195562b2332d4df91b7ab07b0443d66aaff41a0cfcac032a27380f65f8fae0e67737360126e7c25b0c7831ee91298215a57014aa7137679
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1476	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27
PID 1808 wrote to memory of 1476	1808	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce24bbcefda31d9944a308ab7148bee300758f939f5b5bc00ea7cc6fbc306a54.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ce24bbcefda31d9944a308ab7148bee300758f939f5b5bc00ea7cc6fbc306a54.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

memory/1476-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1476-56-0x0000000000840000-0x000000000088C000-memory.dmp

Download

memory/1808-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download