emotet | 1cf1a83fe760a0e65a090ed57ffe176768a58d96a35b36181288529ded1d3f33

Analysis

Target
bea4f2e2743324f7657e5be14ae9a843.dll
Size 649KB
Sample220607-pwrh1safej
SHA256 1cf1a83fe760a0e65a090ed57ffe176768a58d96a35b36181288529ded1d3f33
MD5 bea4f2e2743324f7657e5be14ae9a843
SHA1 9e5715623e71835e1ddc950d0b137f03ee1fb59d
SHA512 16e8bd9ebaef71ac1d142afabda38c1700d062fb2d11d25027191418abd6041f581136a7c3211a5ea6e9d14f3f413303340e107ba994fddec39d03e0b61c0163
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1052	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1640	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1640	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1640	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1640	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1640	1052	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bea4f2e2743324f7657e5be14ae9a843.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YQflPlqxjxQopg\TyMofANY.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

memory/1052-54-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Download

memory/1052-55-0x0000000000340000-0x00000000003E9000-memory.dmp

Download

memory/1052-57-0x0000000180000000-0x000000018002A000-memory.dmp

Download

memory/1640-62-0x0000000001D80000-0x0000000001E29000-memory.dmp

Download