emotet | dcbe2a9bc77fc9af55d98afbe9efae2d063a3df096d74f06db017fa806465ed5

Analysis

Target
935ff3e004cfbf718d76fddc265b2d91.dll
Size 826KB
Sample220609-cgn35afbe6
SHA256 dcbe2a9bc77fc9af55d98afbe9efae2d063a3df096d74f06db017fa806465ed5
MD5 935ff3e004cfbf718d76fddc265b2d91
SHA1 ce4fc45986df8bb31e24e4ee581fd60fa01a986d
SHA512 f361c368597fb33568fa16f746164ec015ed5c359b682a0c1a56b79b67d545a12188198ca32d56ceee65fdef7877b03b6cd4980c38f1f6b4c62fe9c55bef0a6a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1788	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2028	1788	regsvr32.exe	27
PID 1788 wrote to memory of 2028	1788	regsvr32.exe	27
PID 1788 wrote to memory of 2028	1788	regsvr32.exe	27
PID 1788 wrote to memory of 2028	1788	regsvr32.exe	27
PID 1788 wrote to memory of 2028	1788	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\935ff3e004cfbf718d76fddc265b2d91.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZDjWHzDX\KawhEsQae.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

memory/1788-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download

memory/1788-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download