emotet | 28741d8897781f06facb0aba40a067eaf730beea6982ebad016ec80b37fbf57e

Analysis

Target
a3fd4fa766b7c260af3f2920e48b6e57.dll
Size 496KB
Sample220523-15mf7schdn
SHA256 28741d8897781f06facb0aba40a067eaf730beea6982ebad016ec80b37fbf57e
MD5 a3fd4fa766b7c260af3f2920e48b6e57
SHA1 7243b37bfed07a8e5d3dd9baf7defaeaa85402ae
SHA512 dddd36839a4dea8442e9349daf8b4cd21058e95747639d55839895988e9e51f40eec83fe8163c3f6c1d1ba8cc48190eac1f656ec5c7a024d1f5f9934823b60bc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1676	1304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a3fd4fa766b7c260af3f2920e48b6e57.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a3fd4fa766b7c260af3f2920e48b6e57.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

memory/1304-54-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Download

memory/1676-56-0x0000000076451000-0x0000000076453000-memory.dmp

Download

memory/1676-58-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download