emotet | a72eb86e4f71e920c9fa8eba2308220f17e1ba9b228b2cff535accff816ce8b3

Analysis

Target
ff7c0b055713ef209218ff4b3f244332.dll
Size 764KB
Sample220512-jw4wfsecdk
SHA256 a72eb86e4f71e920c9fa8eba2308220f17e1ba9b228b2cff535accff816ce8b3
MD5 ff7c0b055713ef209218ff4b3f244332
SHA1 a420c39ff15e16b63fede8b435b521d0dd9cf20a
SHA512 91be57742210249a2a11a8799c1a51c014919b8264eec67ab57d0b8e4800ff51dac54227aff1bdf8c2a6d5c9d1c00acdb97651d8f2fe0cd01451ef2e380ce72c
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1876	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1052	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1876	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1876	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1876	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1876	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1876	1052	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff7c0b055713ef209218ff4b3f244332.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BZMwzWVtGihnXYXE\eWNrDNavXsepia.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

memory/1052-54-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Download

memory/1052-55-0x00000000003E0000-0x0000000000410000-memory.dmp

Download