emotet | fcc1d3aa2a6f98311b1f37c3bc4b2b5b70b4c237cc0bfaf12cb0c2784f53a53a

Analysis

Target
bb1e77dda86fced738a07599df297441.dll
Size 826KB
Sample220609-cgn35afbe7
SHA256 fcc1d3aa2a6f98311b1f37c3bc4b2b5b70b4c237cc0bfaf12cb0c2784f53a53a
MD5 bb1e77dda86fced738a07599df297441
SHA1 bd9433e4a6ec1f5ecd8af3004eb13b96d1c2af49
SHA512 1b1ab91117a43bfdd78d040cbcfcd9d2ca9a652a637eae67652bfbbf14cd7b031149f12fd9b416396f48056ecfe92b16cb455e947957c0b5265f896b30b92c98
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
852	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 972	852	regsvr32.exe	27
PID 852 wrote to memory of 972	852	regsvr32.exe	27
PID 852 wrote to memory of 972	852	regsvr32.exe	27
PID 852 wrote to memory of 972	852	regsvr32.exe	27
PID 852 wrote to memory of 972	852	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb1e77dda86fced738a07599df297441.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LnVyjHc\eordyxhBIVLIxD.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/852-54-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp

Download

memory/852-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download