emotet | 964ee5352986e93de65c3c125829aba7cf2fbdb7f95417ae77c35b362eaf35ea

Analysis

Target
7854089430362426d98dc21b9e341ea3.dll
Size 742KB
Sample220519-ye8kmsbcd7
SHA256 964ee5352986e93de65c3c125829aba7cf2fbdb7f95417ae77c35b362eaf35ea
MD5 7854089430362426d98dc21b9e341ea3
SHA1 053f21bf308d1617bdc31f851311e078224c74a1
SHA512 2dc70b145b02ba871c29f61f2f4359297ac7b375848a5107df4e608100251ab0dfb016ae946539a4a596ed08fdbc3b167837f5e1bb13368b9a99749b154f967e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1832	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1452	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1832	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1832	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1832	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1832	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1832	1452	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7854089430362426d98dc21b9e341ea3.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LcBOxmSenK\yxpVJ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832

memory/1452-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Download

memory/1452-55-0x0000000180000000-0x0000000180031000-memory.dmp

Download