emotet | 6d3d61fa2f6254dffb8fd40384cd0396ee5e9af84d96b2ee45711270d2bb670c

Analysis

Target
emotet_epoch4.dll
Size 501KB
Sample220511-qncwbsbbhl
SHA256 6d3d61fa2f6254dffb8fd40384cd0396ee5e9af84d96b2ee45711270d2bb670c
MD5 02ac07df0fa4e54a7156be35f408b939
SHA1 2bc58d529e9d6251b28e1ca0b58a44916d54c140
SHA512 2a6e5b045c4c7d307644c5fe2743890c741f7d40da7199965dbbdc8c7e254aa69971c6c16ad95080570170988fcb3d7b01a7ee5884a04178dc1f260f17bb7c98
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1204	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1204	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1204	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1204	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1204	1732	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_epoch4.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OjxBexuhjekWgT\QpNYYdoIrettQm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204

memory/1732-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Download

memory/1732-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download