emotet | b5dc7a71bb551c117f351f1bb86973224e73b1ff39b3710451e2d214418c9106

Analysis

Target
b5dc7a71bb551c117f351f1bb86973224e73b1ff39b3710451e2d214418c9106.dll
Size 684KB
Sample220323-phbkmsacer
SHA256 b5dc7a71bb551c117f351f1bb86973224e73b1ff39b3710451e2d214418c9106
MD5 a9f88ffd5ff0aafc14474a85b40c1270
SHA1 1ea805f351b6736d3186059ca68225c7c2038690
SHA512 60c16bbee65c129e0c297dfcd5b2d984017500aa9080e6da58c7327a89630d7dde4b9780a735dd2508c37d09b28fe4b967a23d4a9e61cbd49a7da0273b4a0aef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1328	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1328	1676	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b5dc7a71bb551c117f351f1bb86973224e73b1ff39b3710451e2d214418c9106.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b5dc7a71bb551c117f351f1bb86973224e73b1ff39b3710451e2d214418c9106.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

memory/1328-56-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Download

memory/1328-57-0x0000000000190000-0x00000000001B7000-memory.dmp

Download

memory/1676-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Download