emotet | f57a63a8a2c7aa1ee5f4253218b87856d6d2986e49d9a2eeaf2bfa064bb7c0ef

Analysis

Target
xcah3.dll
Size 432KB
Sample220401-xprjfabheq
SHA256 f57a63a8a2c7aa1ee5f4253218b87856d6d2986e49d9a2eeaf2bfa064bb7c0ef
MD5 dd515971b029e160e9f6b91efa32070e
SHA1 2217cf426b44814632fe40b91be60b560aa4a084
SHA512 68c72979aa523f2580b29bbc23dba85e977193b31399292bc773cef420fcf4ca9e11b77a3185b9f4a8fa122908bca030b7e6da0f8077740a06c80fc1282c73f1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4960	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Psoeuzalcr\thtjdqowvck.bgi	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	regsvr32.exe
4960	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4876	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4876	4936	regsvr32.exe	76
PID 4936 wrote to memory of 4876	4936	regsvr32.exe	76
PID 4936 wrote to memory of 4876	4936	regsvr32.exe	76
PID 4876 wrote to memory of 4960	4876	regsvr32.exe	77
PID 4876 wrote to memory of 4960	4876	regsvr32.exe	77
PID 4876 wrote to memory of 4960	4876	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xcah3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xcah3.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Psoeuzalcr\thtjdqowvck.bgi"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4960

thtjdqowvck.bgi

Path C:\Windows\SysWOW64\Psoeuzalcr\thtjdqowvck.bgi
Size 432KB
SHA256 f57a63a8a2c7aa1ee5f4253218b87856d6d2986e49d9a2eeaf2bfa064bb7c0ef
MD5 dd515971b029e160e9f6b91efa32070e
SHA1 2217cf426b44814632fe40b91be60b560aa4a084
SHA512 68c72979aa523f2580b29bbc23dba85e977193b31399292bc773cef420fcf4ca9e11b77a3185b9f4a8fa122908bca030b7e6da0f8077740a06c80fc1282c73f1
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDAS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK4rsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4876-126-0x0000000002D90000-0x0000000002DB3000-memory.dmp

Download

memory/4960-130-0x00000000024D0000-0x00000000024F3000-memory.dmp

Download