emotet | bdb195ea4dd8eb3908fe3bab6857cb06be70798dd1f09f25be8348d2dbf9a4f6

Analysis

Target
0fa71c508fb14b9603ff942d8dac0220.dll
Size 532KB
Sample220513-lkwrtaece8
SHA256 bdb195ea4dd8eb3908fe3bab6857cb06be70798dd1f09f25be8348d2dbf9a4f6
MD5 0fa71c508fb14b9603ff942d8dac0220
SHA1 9d3bcc92ce3a8d7d68674294bba477eb1576fd20
SHA512 02906068f74b31db3cf932518413047058d4298279bcfee0c84bab6014943a210951831f7b2f9103e3ef572fabcc7787644b58b581c6628b2d7b5d745bf860e7
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1380	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
836	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1380	836	regsvr32.exe	27
PID 836 wrote to memory of 1380	836	regsvr32.exe	27
PID 836 wrote to memory of 1380	836	regsvr32.exe	27
PID 836 wrote to memory of 1380	836	regsvr32.exe	27
PID 836 wrote to memory of 1380	836	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fa71c508fb14b9603ff942d8dac0220.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DAugY\prrHqhLEh.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380

memory/836-54-0x000007FEFBFA1000-0x000007FEFBFA3000-memory.dmp

Download

memory/836-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download