emotet | f7108299015b83087281af1fc7bdb2b7d9131db9e63e95f706c3513d65796853

Analysis

Target
f7108299015b83087281af1fc7bdb2b7d9131db9e63e95f706c3513d65796853.dll
Size 684KB
Sample220323-pmxzfaadhm
SHA256 f7108299015b83087281af1fc7bdb2b7d9131db9e63e95f706c3513d65796853
MD5 e6fe3376e32f258ffb09a3e26dc8772f
SHA1 9872a64048540f2840b11dd62c38d7d3f9e541f8
SHA512 ab65cdf967f8f897a40b8bae893170d218466db2866da28c055086760e83ec0d96e704cd35e1d98045dce0313886982131b8dca5ba7fd423956c375b34cfaa3d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1988	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1988	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7108299015b83087281af1fc7bdb2b7d9131db9e63e95f706c3513d65796853.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f7108299015b83087281af1fc7bdb2b7d9131db9e63e95f706c3513d65796853.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

memory/1988-56-0x0000000075041000-0x0000000075043000-memory.dmp

Download

memory/1988-57-0x0000000000280000-0x00000000002A7000-memory.dmp

Download

memory/2016-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Download