emotet | a877c1cecfef06fa2e15deb5a7d8159ff276c8b587e97d6235f15f4ddd18e944

Analysis

Target
a877c1cecfef06fa2e15deb5a7d8159ff276c8b587e97d6235f15f4ddd18e944.dll
Size 684KB
Sample220323-pgtd3aacdp
SHA256 a877c1cecfef06fa2e15deb5a7d8159ff276c8b587e97d6235f15f4ddd18e944
MD5 aad27ca59173ec546c5d4257977eec5e
SHA1 fb6b697e2a89edfaa3889d39d51ab1d07ea8b827
SHA512 daf8f5ec6c6e134d8874dac55c5d8722b439577c7e9ac1d890448fbb9fca4265a7c1d7b7ae6778dd6bfef844766e817f1fab31f29430ad7a2b1beb973ff2ec26
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
972	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a877c1cecfef06fa2e15deb5a7d8159ff276c8b587e97d6235f15f4ddd18e944.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a877c1cecfef06fa2e15deb5a7d8159ff276c8b587e97d6235f15f4ddd18e944.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/952-54-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Download

memory/972-56-0x00000000760A1000-0x00000000760A3000-memory.dmp

Download

memory/972-57-0x00000000002B0000-0x00000000002D7000-memory.dmp

Download