emotet | 31e23df39f9662cc5dcb3f2e99ac8acc9b83ff7c6eee543fbb0ea3c4691cb9bf

Analysis

Target
bdbfa4ddff8f0cb457595fd9901d7953.dll
Size 465KB
Sample220517-svq3msgfcq
SHA256 31e23df39f9662cc5dcb3f2e99ac8acc9b83ff7c6eee543fbb0ea3c4691cb9bf
MD5 bdbfa4ddff8f0cb457595fd9901d7953
SHA1 33f79805d5bdeba7e985ff8d533bf60bcb66469c
SHA512 74b2cb0dc173d55d23ebe41ed8c8a206e7ee6deba3e3b0b471db0e77e3e1b4f670ade86d69fc55ff60c3b3f62c2dd9545086f24d00dbbe8739b8c8226c2e612f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1216	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1100	1216	regsvr32.exe	28
PID 1216 wrote to memory of 1100	1216	regsvr32.exe	28
PID 1216 wrote to memory of 1100	1216	regsvr32.exe	28
PID 1216 wrote to memory of 1100	1216	regsvr32.exe	28
PID 1216 wrote to memory of 1100	1216	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bdbfa4ddff8f0cb457595fd9901d7953.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ClfmewhVND\BXATMdiGWbG.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

memory/1216-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download

memory/1216-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download