emotet | 95d0519cec69e64ac5cc72d2b1e9f57bbf67606a90eacc451ec63d6e841e48d4

Analysis

Target
8i0xhPv1QoOroH.dll
Size 757KB
Sample220519-rbjc1sbbdn
SHA256 95d0519cec69e64ac5cc72d2b1e9f57bbf67606a90eacc451ec63d6e841e48d4
MD5 dfb3f371e06e49e616584c14ecd53d37
SHA1 fa35263727c76ff9a30a7a6c0a34be1067e6e800
SHA512 2a55f4c2329b50b320ef61f10f56ee8eb080cf6858579b690f555941596334d4d6901c268b3da57b75e05e3fc38ac5080d03d3190cfe558da976ea1bd7b7f288
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1116	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1116	1528	regsvr32.exe	28
PID 1528 wrote to memory of 1116	1528	regsvr32.exe	28
PID 1528 wrote to memory of 1116	1528	regsvr32.exe	28
PID 1528 wrote to memory of 1116	1528	regsvr32.exe	28
PID 1528 wrote to memory of 1116	1528	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8i0xhPv1QoOroH.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PIPLBig\TBncCswfLCJcrzn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

memory/1528-54-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmp

Download

memory/1528-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download