emotet | 6661ec986e5a8047e182a0af44af0c8b41ed751f44dfeb0bd1bf5f8c84afb30f

Analysis

Target
1313fd2fd0025f379fbd9bf0ef9346e1.dll
Size 518KB
Sample220612-bmsstsced9
SHA256 6661ec986e5a8047e182a0af44af0c8b41ed751f44dfeb0bd1bf5f8c84afb30f
MD5 1313fd2fd0025f379fbd9bf0ef9346e1
SHA1 bc92cd587208c0a0e2a5b9b1e8d9c190ad83abc9
SHA512 53d3b3fa4ff22646b683beeef7ad4ebf43b2e6c3ae66c8774d02cb0202d17d70f60b23042c7526729a822f882ee611a1d070e7c3ee55d8456f5553ef6f70e66d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1992	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1313fd2fd0025f379fbd9bf0ef9346e1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LPixZoTTo\VDioYxJvpmj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

memory/1992-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Download

memory/1992-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download