emotet | d1cdaa79971b9cbcb4b0f61a9ff2ad4e21fc38b7d5d52b199c6917f6739db59f

Analysis

Target
908a395ba5f7dbbf6dc6bd04e9e8cbe1.dll
Size 646KB
Sample220610-eng99sfccn
SHA256 d1cdaa79971b9cbcb4b0f61a9ff2ad4e21fc38b7d5d52b199c6917f6739db59f
MD5 908a395ba5f7dbbf6dc6bd04e9e8cbe1
SHA1 41100fad51b4a500e9472ccb539176eb788b1c20
SHA512 faf19afcd47d54e0c8736bf9af400a233219a957a55295021bb101c916d53da236cbc3620bfeaef7088303cbc3e6a7a65fd7074198df3e3279169b6487a721fb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
644	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\908a395ba5f7dbbf6dc6bd04e9e8cbe1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IyswmhUZ\iPDzvjlmxlHI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144

memory/644-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/644-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download