emotet | bd52735ce398c058e7bdefa62befcbdd5aefda04257845a3fb135bfbd836ce5b

Analysis

Target
9584d71bdb3395a0cf930be5f49f1a60.dll
Size 432KB
Sample220401-lkbrmseagj
SHA256 bd52735ce398c058e7bdefa62befcbdd5aefda04257845a3fb135bfbd836ce5b
MD5 9584d71bdb3395a0cf930be5f49f1a60
SHA1 2f85b1667ec3659e26cc4ad80c016be291426cf1
SHA512 2d8b50524e41ee82a4acc2387ded838ab7e4e7759d58c084c68bc025a07dead343e335694456a4d5f44dbc2992825d66acd17514b4e3e1e2a627249d3d78dfc4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27
PID 1988 wrote to memory of 1980	1988	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9584d71bdb3395a0cf930be5f49f1a60.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9584d71bdb3395a0cf930be5f49f1a60.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

memory/1980-56-0x0000000075931000-0x0000000075933000-memory.dmp

Download

memory/1980-57-0x00000000001C0000-0x00000000001E3000-memory.dmp

Download

memory/1988-54-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Download