emotet | 90ee0707d0b20c178a63fa8c10b7398254bb38bf66c8d6f479e85d1118ad4ccf

Analysis

Target
SecuriteInfo.com.BehavesLike.Win64.Trojan.jh.2508.dll
Size 669KB
Sample220607-cy53zaech7
SHA256 90ee0707d0b20c178a63fa8c10b7398254bb38bf66c8d6f479e85d1118ad4ccf
MD5 183a025b1dbee83ed78bf049ad873e01
SHA1 399907bbed4cd3b3ee32d89cb7e8120053a76373
SHA512 3be3f9f058257db4ca3719fe7da416e91ffa7d758086393bb5693d5b59a6ae78be47f336cd6c05395de30de2e9a127ff66dfdd2c23f0c8a75ac32ddb656917a8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1452	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1660	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1660	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1660	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1660	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1660	1452	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win64.Trojan.jh.2508.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VjFDt\HmBZjNdaLyFCKm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

memory/1452-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Download

memory/1452-55-0x0000000001D90000-0x0000000001E3D000-memory.dmp

Download

memory/1452-57-0x0000000180000000-0x000000018002B000-memory.dmp

Download

memory/1660-62-0x0000000000420000-0x00000000004CD000-memory.dmp

Download