emotet | a356cfa92783af2ffae8efaaa99f505748a60c9021b1cdb0adc8b84d4d6bdffd

Analysis

Target
a356cfa92783af2ffae8efaaa99f505748a60c9021b1cdb0adc8b84d4d6bdffd.dll
Size 684KB
Sample220323-pgtd3aacdn
SHA256 a356cfa92783af2ffae8efaaa99f505748a60c9021b1cdb0adc8b84d4d6bdffd
MD5 58d2d9fd51ffa8f230f446285721bccb
SHA1 7c36d84b83993b8a511921fdb64fe4eb501ea896
SHA512 45c4aa3091433b24e7dd07a5d7eae004224b186b5281a984e80d05e4dd5888a4d3171b0294c0a534db5c1c52f1a09e6871b3f2952ba1b51d49fadec6533828e8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1988	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a356cfa92783af2ffae8efaaa99f505748a60c9021b1cdb0adc8b84d4d6bdffd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a356cfa92783af2ffae8efaaa99f505748a60c9021b1cdb0adc8b84d4d6bdffd.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

memory/1988-56-0x0000000075041000-0x0000000075043000-memory.dmp

Download

memory/1988-57-0x00000000009A0000-0x00000000009C7000-memory.dmp

Download

memory/2016-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Download