emotet | 59bb7b2920a364375dafec93d4d8cbbb4489bcd9a28e49cc7614d4cb9d35b682

Analysis

Target
450992844417df97251d95697bc5ee3b.dll
Size 736KB
Sample220520-cbjlfseab9
SHA256 59bb7b2920a364375dafec93d4d8cbbb4489bcd9a28e49cc7614d4cb9d35b682
MD5 450992844417df97251d95697bc5ee3b
SHA1 97e20306b6c4228524de81d00dcdd212e55835ed
SHA512 c985a7415cede349c7d6caf935d4153a9d0a343be92ccd809be4126e50b8fae61d9395c936cea954313c5cb656ae1e5ef6c073fdf061e29f634a8c4633262ec0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1236	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1564	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1236	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1236	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1236	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1236	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1236	1564	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\450992844417df97251d95697bc5ee3b.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JsgCFk\BxaHHCWTsyGrJ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236

memory/1564-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1564-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download