emotet | 3b3dcdd710bf72702f58846f70eee30c3168397a1ea2a3aa5c45772dc36a3e78

Analysis

Target
b40af8ad321fcc01b7a1c5da32a0e6e3.dll
Size 826KB
Sample220609-bt375saffj
SHA256 3b3dcdd710bf72702f58846f70eee30c3168397a1ea2a3aa5c45772dc36a3e78
MD5 b40af8ad321fcc01b7a1c5da32a0e6e3
SHA1 69927ef599e719483a0dcda38e4c5ea634b76ca3
SHA512 37f8b1849f35de6095a3ffae7e62e609c9631c79125015abe8c76fecc7daa3bbf2a9686eec7eeab0a0d37696525f1e0e433f92b3dfa0906fe2434b5369519aff
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1936	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 940	1936	regsvr32.exe	27
PID 1936 wrote to memory of 940	1936	regsvr32.exe	27
PID 1936 wrote to memory of 940	1936	regsvr32.exe	27
PID 1936 wrote to memory of 940	1936	regsvr32.exe	27
PID 1936 wrote to memory of 940	1936	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b40af8ad321fcc01b7a1c5da32a0e6e3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BZhOYFSfgus\LgUlvlTjkyd.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940

memory/1936-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Download

memory/1936-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download