emotet | fd0e5bb69bbc685e5c267f28c2ed1a72449d3b5fb71d3fd012a4ec8f6b4bfdfb

Analysis

Target
fd0e5bb69bbc685e5c267f28c2ed1a72449d3b5fb71d3fd012a4ec8f6b4bfdfb.dll
Size 684KB
Sample220323-pmxzfaadhq
SHA256 fd0e5bb69bbc685e5c267f28c2ed1a72449d3b5fb71d3fd012a4ec8f6b4bfdfb
MD5 1b1f8a83e7efa6fa5cffd9c2b89a0802
SHA1 a1fb6f4b7d95f1c805bb61bbba3f94689949b4bd
SHA512 76cdc684f720966aa7aeb1e9d5faf138eea305dc07cd0c92569b589724ceb490d440e316b8482dae71ae6c888d20649973668b4c316bbe643fc3978501da922f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd0e5bb69bbc685e5c267f28c2ed1a72449d3b5fb71d3fd012a4ec8f6b4bfdfb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fd0e5bb69bbc685e5c267f28c2ed1a72449d3b5fb71d3fd012a4ec8f6b4bfdfb.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

memory/1092-56-0x0000000074F31000-0x0000000074F33000-memory.dmp

Download

memory/1092-57-0x0000000000390000-0x00000000003B7000-memory.dmp

Download

memory/1888-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Download