emotet | f57a63a8a2c7aa1ee5f4253218b87856d6d2986e49d9a2eeaf2bfa064bb7c0ef

Analysis

Target
xcah3.dll
Size 432KB
Sample220401-xprjfabheq
SHA256 f57a63a8a2c7aa1ee5f4253218b87856d6d2986e49d9a2eeaf2bfa064bb7c0ef
MD5 dd515971b029e160e9f6b91efa32070e
SHA1 2217cf426b44814632fe40b91be60b560aa4a084
SHA512 68c72979aa523f2580b29bbc23dba85e977193b31399292bc773cef420fcf4ca9e11b77a3185b9f4a8fa122908bca030b7e6da0f8077740a06c80fc1282c73f1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1836	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1836	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xcah3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xcah3.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

memory/1836-56-0x0000000075D31000-0x0000000075D33000-memory.dmp

Download

memory/1836-57-0x0000000000190000-0x00000000001B3000-memory.dmp

Download

memory/2016-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Download