emotet | 5df779fe3afd156a3ecd32ef3de025d86105db4ebf061f818082e2e805f4e5b5

Analysis

Target
PY8.dll
Size 432KB
Sample220401-kpavgaddhm
SHA256 5df779fe3afd156a3ecd32ef3de025d86105db4ebf061f818082e2e805f4e5b5
MD5 1cf2523001cb7d84a3ba9f9cf7bc5956
SHA1 858c8b4cda5f4ec72d7875bccee257cf0b63799f
SHA512 37ca8886d5b7f8188170b0e1ddc767eec40ba203a2fc94672fd89032cba642ae7b369078eaa31839249278a7c617a73604149ed65f9a99332bc4b158fe22c01f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1040	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27
PID 1760 wrote to memory of 1040	1760	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PY8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\PY8.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040

memory/1040-56-0x0000000075E61000-0x0000000075E63000-memory.dmp

Download

memory/1040-57-0x00000000001E0000-0x0000000000203000-memory.dmp

Download

memory/1760-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download