emotet | a2398435665f739741f2e7decd588a25d29db043295a27fbe95b4ac20536666e

Analysis

Target
xKk5yCPYyrc.dll
Size 808KB
Sample220323-kjddeafadj
SHA256 a2398435665f739741f2e7decd588a25d29db043295a27fbe95b4ac20536666e
MD5 8980537347fc3630e9476c6f367c3102
SHA1 f52e8be8f523ae7d77acd02c7b3d5e6338973a72
SHA512 3a63c6530a06f45bd9de37f8357f96247c4e8f0b9f57fb345aac6cad2d196977d0373b8c594b160709103edae0f9bd0ce0f61912a370fdd9d90ba27823eb9a6c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1088	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1088	1688	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xKk5yCPYyrc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xKk5yCPYyrc.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

memory/1088-56-0x0000000075C41000-0x0000000075C43000-memory.dmp

Download

memory/1088-57-0x0000000000530000-0x0000000000554000-memory.dmp

Download

memory/1688-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Download