emotet | f18b6ee971a32edcf85ae53579b8e7adec8d5a96edc06c1ee333be6529568a8e

Analysis

Target
34856ed4a5979b99669b4ebdbc2f018f.dll
Size 653KB
Sample220607-v3qsysaean
SHA256 f18b6ee971a32edcf85ae53579b8e7adec8d5a96edc06c1ee333be6529568a8e
MD5 34856ed4a5979b99669b4ebdbc2f018f
SHA1 e0c32adb1d8bd69e4da355b29be18a0f9a932d96
SHA512 3c2fc74f470f5967dcb90d6cd943a3dbcb3ad3aba464fb78bde0f0e91d79e5a04a164656dd9944cf0911c81eb9e597c72800068abd8577611da984656df7f34e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
548	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1568	548	regsvr32.exe	27
PID 548 wrote to memory of 1568	548	regsvr32.exe	27
PID 548 wrote to memory of 1568	548	regsvr32.exe	27
PID 548 wrote to memory of 1568	548	regsvr32.exe	27
PID 548 wrote to memory of 1568	548	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\34856ed4a5979b99669b4ebdbc2f018f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AZUhNhylVqV\jmxFSHuIpgFp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568

memory/548-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Download

memory/548-55-0x0000000001E40000-0x0000000001EEA000-memory.dmp

Download

memory/548-57-0x0000000180000000-0x000000018002B000-memory.dmp

Download

memory/1568-62-0x0000000000410000-0x00000000004BA000-memory.dmp

Download