emotet | 28751f444cba6f03cdda9e830fe751e038bf206bc3857ad0c0c58601f28ffdda

Analysis

Target
7ffb3fd00868dbf15772e42898c50109.dll
Size 580KB
Sample220513-jldaragcej
SHA256 28751f444cba6f03cdda9e830fe751e038bf206bc3857ad0c0c58601f28ffdda
MD5 7ffb3fd00868dbf15772e42898c50109
SHA1 46c835a402204837eb3fcae80b369a5e5bd079be
SHA512 b911c50d60dd447a0678a725f3d20843f8588473d1832342befbaf5007cfe07c9534354cb3b812e1d613e2a19edaed61a3cccd48141e5fabcbc4baa518b1c0b7
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1524	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
532	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1524	532	regsvr32.exe	27
PID 532 wrote to memory of 1524	532	regsvr32.exe	27
PID 532 wrote to memory of 1524	532	regsvr32.exe	27
PID 532 wrote to memory of 1524	532	regsvr32.exe	27
PID 532 wrote to memory of 1524	532	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ffb3fd00868dbf15772e42898c50109.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GXBcpbXGWOqww\anjyHUWtaAAzYX.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

memory/532-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Download

memory/532-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download