Overview

overview

10

Static

static

emotet_pe_1min

windows10_x64

10
General
Target

b1db12097fe3b1f2672ad5130fdac72dbb23de1318f7fa6c25758f586c7dbaf7.dll

Filesize

532KB

Completed

14-05-2022 14:50

Task

behavioral1

Score
10/10
MD5

727f543dde9ff81bf066e2713eda2776

SHA1

372bf93fbd57ebeefea7b2d01355f3a966199653

SHA256

b1db12097fe3b1f2672ad5130fdac72dbb23de1318f7fa6c25758f586c7dbaf7

SHA256

ed31b322834fc56f8cb28add37ddc613c7474ec129a8c790ac220ec95915a4546a7ede122a67e4f1227e74b78df5c2cef978059a5e84d9eb7ce539fef782c110

Malware Config
Signatures 5

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

    Tags

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Description

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    Tags

  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    436regsvr32.exe
    436regsvr32.exe
  • Suspicious behavior: RenamesItself
    regsvr32.exe

    Reported IOCs

    pidprocess
    3380regsvr32.exe
  • Suspicious use of WriteProcessMemory
    regsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3380 wrote to memory of 4363380regsvr32.exeregsvr32.exe
    PID 3380 wrote to memory of 4363380regsvr32.exeregsvr32.exe
Processes 2
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b1db12097fe3b1f2672ad5130fdac72dbb23de1318f7fa6c25758f586c7dbaf7.dll
    Suspicious behavior: RenamesItself
    Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GsEtgwbICIYH\EBPmdvq.dll"
      Suspicious behavior: EnumeratesProcesses
      PID:436
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/436-121-0x0000000000000000-mapping.dmp

                            Download

                          • memory/3380-116-0x0000000180000000-0x0000000180030000-memory.dmp

                            Download