emotet | 0ff32dc7f6fbeb28f56475864bf66dc243f70c50445efc8a444314ecc6661f36

Analysis

Target
f5ce5539a522a5403fd985c2cabf9217.dll
Size 422KB
Sample220517-q6dkksffap
SHA256 0ff32dc7f6fbeb28f56475864bf66dc243f70c50445efc8a444314ecc6661f36
MD5 f5ce5539a522a5403fd985c2cabf9217
SHA1 1eec982397acec6a3b38f8c4cf7cdfca3428ff1f
SHA512 f76e29bb4af4f76e1012f73f547a8a210b7fa9e721fe1bb3d28be23e28960719993a7c872258a050bae35aaa250ca0e6ffa16ac06db371b8ef24c1ee928e7704
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
316	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1788	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 316	1788	regsvr32.exe	28
PID 1788 wrote to memory of 316	1788	regsvr32.exe	28
PID 1788 wrote to memory of 316	1788	regsvr32.exe	28
PID 1788 wrote to memory of 316	1788	regsvr32.exe	28
PID 1788 wrote to memory of 316	1788	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5ce5539a522a5403fd985c2cabf9217.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FhQdpN\FcvpmHvSwLUI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316

memory/1788-54-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Download

memory/1788-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download