emotet | 961758008612eaec60d61cda5d3eeb0316f7d4fc9e8e3e3c71cfc2a87e1cf1b3

Analysis

Target
baf2103645fef840e7df291c723842ac.dll
Size 422KB
Sample220517-kbvbyshdc5
SHA256 961758008612eaec60d61cda5d3eeb0316f7d4fc9e8e3e3c71cfc2a87e1cf1b3
MD5 baf2103645fef840e7df291c723842ac
SHA1 8b727d73aaf1b97450b8f170f2fddd71f4030fdf
SHA512 9b569d6399372b9dda6aa0edf1a30340156ead84a9188b9783ce0d886b5d155722ade05304849264c3b52a8c5ba75987ca0967fc4125965cb1566fefa82634d7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2024	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
892	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2024	892	regsvr32.exe	27
PID 892 wrote to memory of 2024	892	regsvr32.exe	27
PID 892 wrote to memory of 2024	892	regsvr32.exe	27
PID 892 wrote to memory of 2024	892	regsvr32.exe	27
PID 892 wrote to memory of 2024	892	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\baf2103645fef840e7df291c723842ac.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YIPjUnaJxxCaxlfN\ZydkBRRPzMlLVA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024

memory/892-54-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Download

memory/892-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download