emotet | c1006d607d2e1c4198fa25b86824fb4f476ed56e3f7cb71ea5b0cf32ae0323db

Analysis

Target
67981d086c03e613f77f73b0ef565a48.dll
Size 496KB
Sample220611-hr3bdscaem
SHA256 c1006d607d2e1c4198fa25b86824fb4f476ed56e3f7cb71ea5b0cf32ae0323db
MD5 67981d086c03e613f77f73b0ef565a48
SHA1 04ef392ec6f7dcd8042f2e9e1d5064a2c3e5bdc0
SHA512 c91cc0c354b7763d4893fac3ffb258261d481071be8fe80aa0b090767136bc85ab8eaa9e67ca48e7648112ee76fb8d9efc5177b26171a6e544570cc08ac63603
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4692	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3776	4692	regsvr32.exe	79
PID 4692 wrote to memory of 3776	4692	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67981d086c03e613f77f73b0ef565a48.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ELzSVzvyiXJe\xwOkjUBsstYb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

memory/4692-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download