emotet | 17fd5d12f4d529fb7194cf86b1ebf6246335b7550ef5285345b72ce2013ae274

Analysis

Target
Eo3htS0.dll
Size 362KB
Sample220520-s76zmacfaj
SHA256 17fd5d12f4d529fb7194cf86b1ebf6246335b7550ef5285345b72ce2013ae274
MD5 7c9d28d4473083f362c5653b81d28cca
SHA1 2b4c11fce56956b255fa392a042be34efd76f4eb
SHA512 072cd18658efd8e0b676918a566443f2599ea6ec363f177e163540e3e7a749bd7a49c17d93bfd8e1a970d53b3dc4768646b855ad9d2553697827f848a3bfb077
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1816	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1544	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1816	1544	regsvr32.exe	28
PID 1544 wrote to memory of 1816	1544	regsvr32.exe	28
PID 1544 wrote to memory of 1816	1544	regsvr32.exe	28
PID 1544 wrote to memory of 1816	1544	regsvr32.exe	28
PID 1544 wrote to memory of 1816	1544	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Eo3htS0.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVkpirwrBLh\UKgEdOHZMl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

memory/1544-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/1544-55-0x0000000180000000-0x0000000180031000-memory.dmp

Download