emotet | dfb6369cc757f82f61863d07f132e7bbd2ed10fee327ecce3ba17240f2ac79c6

Analysis

Target
dfb6369cc757f82f61863d07f132e7bbd2ed10fee327ecce3ba17240f2ac79c6.dll
Size 684KB
Sample220323-pk7e4aaddr
SHA256 dfb6369cc757f82f61863d07f132e7bbd2ed10fee327ecce3ba17240f2ac79c6
MD5 9b9d054a154c1cca20fe53ec7b33aced
SHA1 53d0a6a5aaec03cea4748f04c1231bc0d5997bb7
SHA512 244c4b42d9364886eab30fe2e85f2d38be8ea4e705241028b57ea33693bf891f5021695bc70ff6fdc852ec9ee9ecabdbed01c1d3d3d4d9813128b0a8d32f7550
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dfb6369cc757f82f61863d07f132e7bbd2ed10fee327ecce3ba17240f2ac79c6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dfb6369cc757f82f61863d07f132e7bbd2ed10fee327ecce3ba17240f2ac79c6.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

memory/1092-56-0x0000000074CC1000-0x0000000074CC3000-memory.dmp

Download

memory/1092-57-0x00000000002B0000-0x00000000002D7000-memory.dmp

Download

memory/1648-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Download