emotet | 76dfb32b68058bb4b91763d4b71d148fdc5ecd3968a583a06ba46ecb456f752f

Analysis

Target
triage_dropped_file.dll
Size 649KB
Sample220607-nat7cahhdq
SHA256 76dfb32b68058bb4b91763d4b71d148fdc5ecd3968a583a06ba46ecb456f752f
MD5 251988e84f40b7c2c83f763c89dbf3fd
SHA1 cbbdcbbc9bbf4826ff0709d9e41a51222155e5ab
SHA512 29da146a31f74ca551a56f223d53b7207fa3fd111dec4f93e5a9ca9d5d4d5412bde753b3260b04b2c1912e282cc34dbd7d2beede99ea391acc323bdabe300f5a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
460	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 1144	460	regsvr32.exe	83
PID 460 wrote to memory of 1144	460	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YeZMaKTuhvh\rYgySIkpZlS.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144

memory/460-130-0x0000000002200000-0x00000000022A9000-memory.dmp

Download

memory/460-132-0x0000000180000000-0x000000018002A000-memory.dmp

Download