emotet | d1cdaa79971b9cbcb4b0f61a9ff2ad4e21fc38b7d5d52b199c6917f6739db59f

Analysis

Target
908a395ba5f7dbbf6dc6bd04e9e8cbe1.dll
Size 646KB
Sample220610-eng99sfccn
SHA256 d1cdaa79971b9cbcb4b0f61a9ff2ad4e21fc38b7d5d52b199c6917f6739db59f
MD5 908a395ba5f7dbbf6dc6bd04e9e8cbe1
SHA1 41100fad51b4a500e9472ccb539176eb788b1c20
SHA512 faf19afcd47d54e0c8736bf9af400a233219a957a55295021bb101c916d53da236cbc3620bfeaef7088303cbc3e6a7a65fd7074198df3e3279169b6487a721fb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1148	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3508	1148	regsvr32.exe	78
PID 1148 wrote to memory of 3508	1148	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\908a395ba5f7dbbf6dc6bd04e9e8cbe1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NGUplskSQRxNM\icJJBX.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

memory/1148-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download