emotet | ff08dfc8d3b687c51b3dfc6846576bf579dea38911aacfc7d5add1d923b177e4

Analysis

Target
ff08dfc8d3b687c51b3dfc6846576bf579dea38911aacfc7d5add1d923b177e4.dll
Size 684KB
Sample220323-pmx97sadhr
SHA256 ff08dfc8d3b687c51b3dfc6846576bf579dea38911aacfc7d5add1d923b177e4
MD5 33a9aff9bde1c7037b525274cf791a64
SHA1 34e6221fad5c217f45c49ee285119dff31e93131
SHA512 25059d1053e06d1db90a39e89a1b0fd809df3bdba03af53514881ca42039f527163950f3cd457320ab414a661ddb3cd3d7fb32c6f74d4ebe9a57034c49235036
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1556	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff08dfc8d3b687c51b3dfc6846576bf579dea38911aacfc7d5add1d923b177e4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ff08dfc8d3b687c51b3dfc6846576bf579dea38911aacfc7d5add1d923b177e4.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

memory/740-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download

memory/1556-56-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1556-57-0x0000000000250000-0x0000000000277000-memory.dmp

Download