emotet | 96491061b46ccd5d4e1764fd4023b0d3008025e8d3c09f56f88c508b0aaee6a3

Analysis

Target
96491061b46ccd5d4e1764fd4023b0d3008025e8d3c09f56f88c508b0aaee6a3.dll
Size 996KB
Sample220323-kdpt9aehbr
SHA256 96491061b46ccd5d4e1764fd4023b0d3008025e8d3c09f56f88c508b0aaee6a3
MD5 3233204ae79ae1ba9347a595defb2fc5
SHA1 ade201154c8b9136f4dfebb15b3b3d62a64bf5ee
SHA512 7825abc74c27e47140c8c017183298e82afc172e3e17e8787aac143fe6e8f00ccfd02af2b4bce428873b625b68a440495e5647fb5408b2ee90a5bace38657056
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1936	2020	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\96491061b46ccd5d4e1764fd4023b0d3008025e8d3c09f56f88c508b0aaee6a3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\96491061b46ccd5d4e1764fd4023b0d3008025e8d3c09f56f88c508b0aaee6a3.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

memory/1936-56-0x0000000075271000-0x0000000075273000-memory.dmp

Download

memory/1936-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/2020-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download