emotet | d9f1e50b4da224d49b88fac00a8a993ceaf929bd6946a5d2263b4e0ccd14aca5

Analysis

Target
7563a7305d1fd3802a8558436f42bdb1.dll
Size 757KB
Sample220519-swbdkshac2
SHA256 d9f1e50b4da224d49b88fac00a8a993ceaf929bd6946a5d2263b4e0ccd14aca5
MD5 7563a7305d1fd3802a8558436f42bdb1
SHA1 ba7d74b47e1d44d10e72eda6627f520191dd4327
SHA512 f25f307123fe39648c2418970c9b912cc7f4af8a1a82a5cdba8385146ee325aed8ef7b43e88a4e76b5495fc5ff2e837f297d4cd6441ecc2d43600556da267c0b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2020	1964	regsvr32.exe	27
PID 1964 wrote to memory of 2020	1964	regsvr32.exe	27
PID 1964 wrote to memory of 2020	1964	regsvr32.exe	27
PID 1964 wrote to memory of 2020	1964	regsvr32.exe	27
PID 1964 wrote to memory of 2020	1964	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7563a7305d1fd3802a8558436f42bdb1.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OjMiRJ\stMrzpgnmXqrc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

memory/1964-54-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Download

memory/1964-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download