emotet | 0a2cfb8be0c0aff64323d54b06b70b92785b2325f61b691cab8da09093fc64c1

Analysis

Target
6a59e4d967be102970cc345292372f8c.dll
Size 518KB
Sample220612-bmsstsgbgp
SHA256 0a2cfb8be0c0aff64323d54b06b70b92785b2325f61b691cab8da09093fc64c1
MD5 6a59e4d967be102970cc345292372f8c
SHA1 e225532b2d8aff0ae147992b9ddb76f152c3f8db
SHA512 7b7840413f43c5d896c4ac57cba2620a43a2f78cc242f2f38f0549bc6bf0ca660b4eeb81de2075835fa88a988c7f98dc39a0f04d527d883c8d595482808232eb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1920	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1220	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1220	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1220	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1220	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1220	1920	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a59e4d967be102970cc345292372f8c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KAwRcMvic\TsuyBlMmAZ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

memory/1920-54-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Download

memory/1920-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download