emotet | 1b87e5ed21113f9ae4c9506b6e0b77c837ccdba4dbcbd57c6921191bf72693d4

Analysis

Target
c4739af139af36527d57db22a43fe13e.dll
Size 844KB
Sample220522-aql9saebc2
SHA256 1b87e5ed21113f9ae4c9506b6e0b77c837ccdba4dbcbd57c6921191bf72693d4
MD5 c4739af139af36527d57db22a43fe13e
SHA1 a5856ce94ef4a93805c77536ba15ae8ab97a2bd4
SHA512 081fea17f3377046439874a3c2353a9058f86d3c9dff44f099315d14f8abcd289b52407b44e019dcb354f80674c8c75cebdaff50fbb82f96e437ead28ed790ab
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
360	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 360	800	regsvr32.exe	27
PID 800 wrote to memory of 360	800	regsvr32.exe	27
PID 800 wrote to memory of 360	800	regsvr32.exe	27
PID 800 wrote to memory of 360	800	regsvr32.exe	27
PID 800 wrote to memory of 360	800	regsvr32.exe	27
PID 800 wrote to memory of 360	800	regsvr32.exe	27
PID 800 wrote to memory of 360	800	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c4739af139af36527d57db22a43fe13e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c4739af139af36527d57db22a43fe13e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:360

memory/360-56-0x0000000076561000-0x0000000076563000-memory.dmp

Download

memory/360-57-0x0000000000230000-0x0000000000253000-memory.dmp

Download

memory/800-54-0x000007FEFC0B1000-0x000007FEFC0B3000-memory.dmp

Download