emotet | 1d86bb5faa0f22f735f9e1b52f85e7439e712f500dd21696811d732ab63fdd9e

Analysis

Target
0aa5dda00c5eebb369c721904d443584.dll
Size 465KB
Sample220519-bwtfqagdc4
SHA256 1d86bb5faa0f22f735f9e1b52f85e7439e712f500dd21696811d732ab63fdd9e
MD5 0aa5dda00c5eebb369c721904d443584
SHA1 eb77bf656584c8e393c750f0f70dc2a2f993e259
SHA512 b9987292244d78f8864e42613ebe316fca6ee2d0f036710c067b6ef0d0db1686eec60e2e604e4fe2163c8926e663ca0e97306b3f1a0213d14b489a1601eded54
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1744	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1364	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1744	1364	regsvr32.exe	28
PID 1364 wrote to memory of 1744	1364	regsvr32.exe	28
PID 1364 wrote to memory of 1744	1364	regsvr32.exe	28
PID 1364 wrote to memory of 1744	1364	regsvr32.exe	28
PID 1364 wrote to memory of 1744	1364	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0aa5dda00c5eebb369c721904d443584.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CrwUcPyv\vnnqdMEIX.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

memory/1364-54-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Download

memory/1364-55-0x0000000180000000-0x0000000180032000-memory.dmp

Download