emotet | 45cdea2b80b133677da888bf2db4c5012e5d561135f4d51e5fdf27c2f3a20215

Analysis

Target
1f936708474a93b189e300f034aab593.dll
Size 496KB
Sample220611-back3sdff8
SHA256 45cdea2b80b133677da888bf2db4c5012e5d561135f4d51e5fdf27c2f3a20215
MD5 1f936708474a93b189e300f034aab593
SHA1 b2be0933ba038b83155087111b025e7a83de4bbc
SHA512 0d8ea9e415d90c20457745cad5f0b6dbf4f6944795b10e51e6c2b155e38a68856c9f86839167dfdf773b8d886015ae14d8d3652dbed577179c4438f4e5bf3a15
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2076	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 904	2076	regsvr32.exe	80
PID 2076 wrote to memory of 904	2076	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f936708474a93b189e300f034aab593.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BPpAxyfhlFUPuD\rUsuL.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904

memory/2076-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download