emotet | c58c7a7468d8a326160627281cd0dd96ed91af6d18a6887ccb0325475f8a2b73

Analysis

Target
a561d800086abf1a6616e306b1a01ab5.dll
Size 364KB
Sample220517-d4rm7sefd2
SHA256 c58c7a7468d8a326160627281cd0dd96ed91af6d18a6887ccb0325475f8a2b73
MD5 a561d800086abf1a6616e306b1a01ab5
SHA1 5920f040833c635b4e3128d01c469e3d3a92da20
SHA512 6b437662d4bc42d8e278dfdcfbc004677e74cd69cda7dc63ea6505058d09aefbcfe6e69d1ff0d10f6b699180f4717199642007ff4bd34970a8ea4c50860409aa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1648	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1632	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1648	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1648	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1648	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1648	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1648	1632	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a561d800086abf1a6616e306b1a01ab5.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NgmCIC\qukgBDTlstTje.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648

memory/1632-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/1632-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download