emotet | d78e2271694831e1984ff2832c712dfea62352b2a30b1fe11d75b8e4b5506884

Analysis

Target
28d983dea2c8f026bd0038452315f321.dll
Size 649KB
Sample220607-qsrv2sehd2
SHA256 d78e2271694831e1984ff2832c712dfea62352b2a30b1fe11d75b8e4b5506884
MD5 28d983dea2c8f026bd0038452315f321
SHA1 0e02c920d3e250af8c400161be4b1e5c4f3c1e24
SHA512 3ac83d0d0bd3c6c258d96742bad5707f4db0fcf3de4edf43ede5f514c064eceabecce03d725e331b90585a4dc8e484a467540ae2da7db8fab64c1bed3b412cec
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1448	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1100	1448	regsvr32.exe	28
PID 1448 wrote to memory of 1100	1448	regsvr32.exe	28
PID 1448 wrote to memory of 1100	1448	regsvr32.exe	28
PID 1448 wrote to memory of 1100	1448	regsvr32.exe	28
PID 1448 wrote to memory of 1100	1448	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\28d983dea2c8f026bd0038452315f321.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ILovbcSlIG\pGHzr.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

memory/1100-62-0x0000000001DD0000-0x0000000001E79000-memory.dmp

Download

memory/1448-54-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmp

Download

memory/1448-55-0x0000000001CD0000-0x0000000001D79000-memory.dmp

Download

memory/1448-57-0x0000000180000000-0x000000018002A000-memory.dmp

Download