emotet | a4004d738bc28ce82f33eabd28efa7ed7e649909f8aac891a9b2dcdcaba8d3d2

Analysis

Target
fdaa5bda98bae36fe55025e2b90b5f6c.dll
Size 586KB
Sample220513-klen9adhf3
SHA256 a4004d738bc28ce82f33eabd28efa7ed7e649909f8aac891a9b2dcdcaba8d3d2
MD5 fdaa5bda98bae36fe55025e2b90b5f6c
SHA1 3ee2663f2b921c11b835c1f683b7aa2bb119576b
SHA512 2ed78ea67b2ce7e311f6b2d4107b5ed1f02c5cd848408c00fcd70c2de732167fdf0a163f10d0f8506ffb248cf15c174772b1fb2879578c991f72e26245438c1c
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1060	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
452	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1060	452	regsvr32.exe	28
PID 452 wrote to memory of 1060	452	regsvr32.exe	28
PID 452 wrote to memory of 1060	452	regsvr32.exe	28
PID 452 wrote to memory of 1060	452	regsvr32.exe	28
PID 452 wrote to memory of 1060	452	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fdaa5bda98bae36fe55025e2b90b5f6c.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KWJeANYtDc\ijlvrCquQHr.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060

memory/452-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/452-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download