emotet | 5f06589caa3aed7818158b76a908e826e12f4f6ae47741fd264570a11bbfc308

Analysis

Target
QBbnHMWRxcs5J.dll
Size 364KB
Sample220516-wlcenseedn
SHA256 5f06589caa3aed7818158b76a908e826e12f4f6ae47741fd264570a11bbfc308
MD5 95abd457fd77ae31bbc2e05425eaf04f
SHA1 d2040e63d1ca2f09a3f904dc3cde9568fd4cc06c
SHA512 f83e0c6f2fd64158646a03168e315e9f782947d7c6f7fb79facd1008e51ecd4f963299d31bbcabfffef12ab6222d1141f76bbfdf283fb498111c9fe3677652be
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1732	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1612	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1732	1612	regsvr32.exe	28
PID 1612 wrote to memory of 1732	1612	regsvr32.exe	28
PID 1612 wrote to memory of 1732	1612	regsvr32.exe	28
PID 1612 wrote to memory of 1732	1612	regsvr32.exe	28
PID 1612 wrote to memory of 1732	1612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QBbnHMWRxcs5J.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TRaEZcxe\ufQTmlsyvbvK.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732

memory/1612-54-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Download

memory/1612-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download