emotet | 673b9d0a455cea6f4dd43b4936990831aeb45a3b47db6e5778d18bffa42a8ee8

Analysis

Target
572bdf2925a6af2474785a7d4788c397.dll
Size 356KB
Sample220521-defjmsafbr
SHA256 673b9d0a455cea6f4dd43b4936990831aeb45a3b47db6e5778d18bffa42a8ee8
MD5 572bdf2925a6af2474785a7d4788c397
SHA1 49d3fef5f934ae2a972bf316b0692dbfc1844a06
SHA512 845cac4b81494c35b198c2d8b3498515f4586570656bd723d04000f803210b54b7a6d153c4cf3961dfe4244dfc4d9119c84a18bd54a9d977cbe9e3157b68923d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1960	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1936	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1960	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1960	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1960	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1960	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1960	1936	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\572bdf2925a6af2474785a7d4788c397.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TzRFZvaiqsxFIIUo\kmfZYtTgGmloDiK.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

memory/1936-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Download

memory/1936-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download