emotet | d6184745bb1cee76609d41fb49a124a0802ed0bc87b32c6d134871189cb47ff2

Analysis

Target
d6184745bb1cee76609d41fb49a124a0802ed0bc87b32c6d134871189cb47ff2.dll
Size 780KB
Sample220322-rtm4xscdbr
SHA256 d6184745bb1cee76609d41fb49a124a0802ed0bc87b32c6d134871189cb47ff2
MD5 6e7709c784163899b7510371c3718931
SHA1 aa9743238948a4e43eb87d761ab3d5bed40c1c2b
SHA512 e5718f8cd0738c86b3ab05f9a324a40a78834126c2935deea4b1da22b190a7f3b27cfcc9e7f0d381a66fcb174aa57c8f0c50c454b71c759d16a008c96a15c73e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
972	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27
PID 2040 wrote to memory of 972	2040	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d6184745bb1cee76609d41fb49a124a0802ed0bc87b32c6d134871189cb47ff2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d6184745bb1cee76609d41fb49a124a0802ed0bc87b32c6d134871189cb47ff2.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/972-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Download

memory/972-56-0x0000000000530000-0x000000000057C000-memory.dmp

Download

memory/2040-54-0x000007FEFB9D1000-0x000007FEFB9D3000-memory.dmp

Download