emotet | 0749ae4fbaba4c32165fe6a257b19a932fa89ffa0a5831d8ffad9b47725b2d18

Analysis

Target
b2f3a9acd3ae06bbe2441ecafd705cdd.dll
Size 667KB
Sample220512-183mladfbm
SHA256 0749ae4fbaba4c32165fe6a257b19a932fa89ffa0a5831d8ffad9b47725b2d18
MD5 b2f3a9acd3ae06bbe2441ecafd705cdd
SHA1 fd12113bdb88044f8fbe49b5af196bd62170065a
SHA512 766e44203359f682e2fe04eee4b115a6c1e0083077ccfc8a27b8c85473364dc05cbb5585f5c229886af3c94c76ea3222c613e63ab42ccbe87865707180d86825
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1576	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1344	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1576	1344	regsvr32.exe	27
PID 1344 wrote to memory of 1576	1344	regsvr32.exe	27
PID 1344 wrote to memory of 1576	1344	regsvr32.exe	27
PID 1344 wrote to memory of 1576	1344	regsvr32.exe	27
PID 1344 wrote to memory of 1576	1344	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b2f3a9acd3ae06bbe2441ecafd705cdd.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MfivXVv\cGiS.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576

memory/1344-54-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp

Download

memory/1344-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download