emotet | 7742912632e38634add52f0f20dfe147db2bb0617942169fedc3ea2809aa4aa8

Analysis

Target
36ac8a71911d8328b429574e118c46e4.dll
Size 356KB
Sample220520-tymp3adcgl
SHA256 7742912632e38634add52f0f20dfe147db2bb0617942169fedc3ea2809aa4aa8
MD5 36ac8a71911d8328b429574e118c46e4
SHA1 a44268f96ec549b142a6e1ef8387c101c71c283f
SHA512 6c1a822e4398f0abce62a268082c221a36316e717126fbd02a90ee235c58f6aedc2d25131ff801aebaa2dfd1ae665635ea05d44bd2c4b250360ebde203811622
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1880	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
388	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1880	388	regsvr32.exe	28
PID 388 wrote to memory of 1880	388	regsvr32.exe	28
PID 388 wrote to memory of 1880	388	regsvr32.exe	28
PID 388 wrote to memory of 1880	388	regsvr32.exe	28
PID 388 wrote to memory of 1880	388	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\36ac8a71911d8328b429574e118c46e4.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ThntcBxnHGYMCdxv\mxyqTQbyXhjpILz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

memory/388-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Download

memory/388-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download