emotet | ea5615a0e070267d930c44e9b58d7c5be166d7d7a8107f12a97027e8d22e3eaf

Analysis

Target
3b973027fb66a0944f3547b8e6bda58a.dll
Size 736KB
Sample220520-cxevdshbhp
SHA256 ea5615a0e070267d930c44e9b58d7c5be166d7d7a8107f12a97027e8d22e3eaf
MD5 3b973027fb66a0944f3547b8e6bda58a
SHA1 57b5978df98b86781e442a3da2c8c314c5279664
SHA512 cc437ebd569457ed215a339fb5b5f7b3f1c708d7515d7e7753b53433f645ea597394754acefd0e57238eda6d67ba3ddf42c9b16b3763701ae03a6a9d68fff638
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1068	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1688	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1068	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1068	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1068	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1068	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1068	1688	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b973027fb66a0944f3547b8e6bda58a.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PveRjnWvRBk\ADYjkTtz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

memory/1688-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download

memory/1688-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download