Overview

overview

10

Static

static

emotet_pe_1min

windows10_x64

10
General
Target

6424a22ef999dfca274849a100d9a2a26fce073d34f9f0c299227199c6b47790.dll

Filesize

532KB

Completed

14-05-2022 14:51

Task

behavioral1

Score
10/10
MD5

91f3a23aa875671455aca03126e34769

SHA1

f2ad391cf7f205a8e5dc086daa3cd470c99c413b

SHA256

6424a22ef999dfca274849a100d9a2a26fce073d34f9f0c299227199c6b47790

SHA256

acfec2fe543f285cb4439e496dcd86c09ef1ef1fc035cee3f56e93a4ee9efa79026c20a928bd7e232369a8e71a2c445af3a8c065c7c3bb5d0baeaf041cd124d7

Malware Config
Signatures 5

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    2780regsvr32.exe
    2780regsvr32.exe
  • Suspicious behavior: RenamesItself
    regsvr32.exe

    Reported IOCs

    pidprocess
    2504regsvr32.exe
  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2504 wrote to memory of 27802504regsvr32.exeregsvr32.exe
    PID 2504 wrote to memory of 27802504regsvr32.exeregsvr32.exe
Processes 2
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6424a22ef999dfca274849a100d9a2a26fce073d34f9f0c299227199c6b47790.dll
    Suspicious behavior: RenamesItself
    Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Rkntp\lBCowglDqIHGMRW.dll"
      Suspicious behavior: EnumeratesProcesses
      PID:2780
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/2504-118-0x0000000180000000-0x0000000180030000-memory.dmp

                            Download

                          • memory/2780-123-0x0000000000000000-mapping.dmp

                            Download