emotet | 54079e2a12310382fa9b31d0c6992b4fd9091651e9699f25323ea56fae55d7d7

Analysis

Target
4297f0eca92a4e38080b0c58972d0b4a.dll
Size 432KB
Sample220401-n4kj1afeem
SHA256 54079e2a12310382fa9b31d0c6992b4fd9091651e9699f25323ea56fae55d7d7
MD5 4297f0eca92a4e38080b0c58972d0b4a
SHA1 1acac5077c4e6fa89d09ef85219d91b29b4be5fa
SHA512 80a62056cec55a637c969ceaa636b3ae04a1a4206539d5443d546accc702ff7eb15b89157c6cd45532e4b24e513d1f3be4c37a20d8910797d719d314a7312a3a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1632	796	regsvr32.exe	27
PID 796 wrote to memory of 1632	796	regsvr32.exe	27
PID 796 wrote to memory of 1632	796	regsvr32.exe	27
PID 796 wrote to memory of 1632	796	regsvr32.exe	27
PID 796 wrote to memory of 1632	796	regsvr32.exe	27
PID 796 wrote to memory of 1632	796	regsvr32.exe	27
PID 796 wrote to memory of 1632	796	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4297f0eca92a4e38080b0c58972d0b4a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4297f0eca92a4e38080b0c58972d0b4a.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

memory/796-54-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Download

memory/1632-56-0x00000000761D1000-0x00000000761D3000-memory.dmp

Download

memory/1632-57-0x0000000000470000-0x0000000000493000-memory.dmp

Download