emotet | b06ebbfc7e23c74c090ac1ceed1d1ee755bdc73e5e2d4ea59d7704255fa757c8

Analysis

Target
87e09bd434ee7965898501d53359cdd9.dll
Size 846KB
Sample220519-bphqmsgce7
SHA256 b06ebbfc7e23c74c090ac1ceed1d1ee755bdc73e5e2d4ea59d7704255fa757c8
MD5 87e09bd434ee7965898501d53359cdd9
SHA1 b4a774601024cae830550e4e151329c0ca74272f
SHA512 797ce818eb41f8c3198ccb6bd718362cbb2ca512b8f83ec013bf4c6b2b468b44bd282f52bc7cfd0a810fa85f1d50943dcb430e16893e2c60e9f6ba62dcd4cc98
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1392	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
656	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1392	656	regsvr32.exe	27
PID 656 wrote to memory of 1392	656	regsvr32.exe	27
PID 656 wrote to memory of 1392	656	regsvr32.exe	27
PID 656 wrote to memory of 1392	656	regsvr32.exe	27
PID 656 wrote to memory of 1392	656	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\87e09bd434ee7965898501d53359cdd9.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OEsbOTei\QxVrcIZPcp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392

memory/656-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/656-55-0x0000000180000000-0x0000000180031000-memory.dmp

Download