emotet | b2992824503aacefdd90225bd99118cf92b3e7659dbca0d52e5e1e0c0a2cd169

Analysis

Target
NsSy.dll
Size 704KB
Sample220331-k8g3wsdfdj
SHA256 b2992824503aacefdd90225bd99118cf92b3e7659dbca0d52e5e1e0c0a2cd169
MD5 f8a93c75fb0f17634c14d2d1d2063d93
SHA1 481ec99b339a052379f8848f3e0336053ed7afdc
SHA512 7e9a187c7221900df814fb1f35048eab6ef6e76d78e8b19ce3f13d6ee8cfb9179f46b417c18ef3767378fb0a71fc04813bc07aec60eaf0f6158a83057c3ffdfa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1624	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1624	1568	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NsSy.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NsSy.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624

memory/1568-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/1624-56-0x0000000075611000-0x0000000075613000-memory.dmp

Download

memory/1624-57-0x0000000000230000-0x0000000000253000-memory.dmp

Download