emotet | 3db54b980748e01508dded127904dba459e61e8ac6c34747ba8d025ea8f2af42

Analysis

Target
3DB54B980748E01508DDED127904DBA459E61E8AC6C34747BA8D025EA8F2AF42.dll
Size 176KB
Sample220608-c76e4aechj
SHA256 3db54b980748e01508dded127904dba459e61e8ac6c34747ba8d025ea8f2af42
MD5 82594080301c53efda4bdc913512d458
SHA1 5db023b2d08253107e47ea2d5566b4bc17def112
SHA512 b846361a760ed1be261b2c4a167cbe400417d37603a5890d48161883d182c2529c12fd53793c370101314dc3502fc5c23781866a191a8e59149d8fd3a6ddd3af
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1348	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1348	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1348	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1348	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1348	1732	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3DB54B980748E01508DDED127904DBA459E61E8AC6C34747BA8D025EA8F2AF42.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EgHZwKaQ\LXdAByyCGx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348

memory/1732-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Download

memory/1732-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download