emotet | 5f711a737008058f610b0a3a613cc502c0bd26de8a1379b59801a7cbb436fe4e

Analysis

Target
fc9f9e28b1d0d4c7f96a884dbab3bb67.dll
Size 492KB
Sample220610-r2eshscbfk
SHA256 5f711a737008058f610b0a3a613cc502c0bd26de8a1379b59801a7cbb436fe4e
MD5 fc9f9e28b1d0d4c7f96a884dbab3bb67
SHA1 560b87efeefda0fc1d6f1209b75b8baa131abfe7
SHA512 d69a177ccc752612fc98f252f06e7075d1d66be11652e156d8dd22fa21ff118a6f6ca43e2692e6f255496beca2bb10a1962afcb58526b2eaec4761b673facc3b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1304	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 968	1304	regsvr32.exe	28
PID 1304 wrote to memory of 968	1304	regsvr32.exe	28
PID 1304 wrote to memory of 968	1304	regsvr32.exe	28
PID 1304 wrote to memory of 968	1304	regsvr32.exe	28
PID 1304 wrote to memory of 968	1304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fc9f9e28b1d0d4c7f96a884dbab3bb67.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HEwSEXBeaGpeF\kyPweW.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968

memory/1304-54-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Download

memory/1304-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download