emotet | 3969bd4495e8bf2644c570257bce60fe45a4f6043e4337b8fc9f8315ef8e6ec8

Analysis

Target
e98458f132bd58ef6319eeb86fb79f4a.dll
Size 518KB
Sample220612-bvpfdachd7
SHA256 3969bd4495e8bf2644c570257bce60fe45a4f6043e4337b8fc9f8315ef8e6ec8
MD5 e98458f132bd58ef6319eeb86fb79f4a
SHA1 01a531866047ad4e717c5b3f6827fdec5d60844b
SHA512 e81931860b0ebaabdbd6800896387ffa71f5342920b6c0e0d28bb594f7992d9d5723c5e8da17fa62b75b4f53a6170550a97bf6de548b80f4ed2ea58ce14b9e33
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1292	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1584	1292	regsvr32.exe	28
PID 1292 wrote to memory of 1584	1292	regsvr32.exe	28
PID 1292 wrote to memory of 1584	1292	regsvr32.exe	28
PID 1292 wrote to memory of 1584	1292	regsvr32.exe	28
PID 1292 wrote to memory of 1584	1292	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e98458f132bd58ef6319eeb86fb79f4a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IFMgUIXVsLtF\CsvW.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584

memory/1292-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/1292-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download