emotet | 0e86c23ba76da871b23a4e5fde0aa3d73f029f3cf3b55e487f6f22234d0d09ae

Analysis

Target
hWrB3WDoDZG2h3AUq4cpWIQivUOEBpPELrn.dll
Size 640KB
Sample220325-te38psefcr
SHA256 0e86c23ba76da871b23a4e5fde0aa3d73f029f3cf3b55e487f6f22234d0d09ae
MD5 9ccf0669bceece9f88c3586a2c727f2b
SHA1 1accc3d9500cb49a0059da769229e844a193fce0
SHA512 73024f10680b18849758b34a56d9cd14ce9f331982eff1671598317cb67aa045224671fee1259c0f1e69a54ed1e67f2f26ccf1b2aae145f0dbac03e73af9c20a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
900	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 900	960	regsvr32.exe	27
PID 960 wrote to memory of 900	960	regsvr32.exe	27
PID 960 wrote to memory of 900	960	regsvr32.exe	27
PID 960 wrote to memory of 900	960	regsvr32.exe	27
PID 960 wrote to memory of 900	960	regsvr32.exe	27
PID 960 wrote to memory of 900	960	regsvr32.exe	27
PID 960 wrote to memory of 900	960	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\hWrB3WDoDZG2h3AUq4cpWIQivUOEBpPELrn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\hWrB3WDoDZG2h3AUq4cpWIQivUOEBpPELrn.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900

memory/900-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Download

memory/900-57-0x00000000001E0000-0x0000000000204000-memory.dmp

Download

memory/960-54-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp

Download