emotet | 2ca3b4150202167be7f9e3e64a25bf097deea8a9b2b0daade26da5774f393964

Analysis

Target
0a8a640b29dcab7e5d94fc2d7645c9d5.dll
Size 787KB
Sample220516-mdrd7agee9
SHA256 2ca3b4150202167be7f9e3e64a25bf097deea8a9b2b0daade26da5774f393964
MD5 0a8a640b29dcab7e5d94fc2d7645c9d5
SHA1 41bf7bfd040e5c8d21d4bb3a1ec3888b54f6e9aa
SHA512 b7b9c60b044457a9bc549bb0850dd6bd0bb7e41f5063b88547a2b817d460caf6d3e0d1526239612bab74d3ebcfa0841c216efe2e3e0c52ca259ab2c89b650a41
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1020	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1020	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1020	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1020	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1020	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1020	1980	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a8a640b29dcab7e5d94fc2d7645c9d5.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GwniEOxrZbpZ\tyaMASLCGl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

memory/1980-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Download

memory/1980-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download