emotet | 6162de37ac64e08df2e0bbaef7c652b77a31d835e2f2f6e501caf3c305a39455

Analysis

Target
9e20b4f5ce7d1b80eb120cabe30f4add.dll
Size 534KB
Sample220606-kcemwsbbfk
SHA256 6162de37ac64e08df2e0bbaef7c652b77a31d835e2f2f6e501caf3c305a39455
MD5 9e20b4f5ce7d1b80eb120cabe30f4add
SHA1 1df55bf4a836b5de9234d6464973adab09f2e6cb
SHA512 276fb84b756739e15967d3f9296e36156fa24fa9439b779f8db178ea90da71ac3872c90314b9e59a9c4ae0fb1f5a5fd0e4cabcebb69b45574549472f0a1029ed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2040	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1488	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1488	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1488	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1488	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1488	2040	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e20b4f5ce7d1b80eb120cabe30f4add.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KEWcaShTqrD\apuhfEJLHlwV.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488

memory/2040-54-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Download

memory/2040-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download