emotet | d09a917ded94ea7b84ddf396f1ebd58b56403f11b19bbc2fa29e35d0bdbb60fe

Analysis

Target
9e410059a2d6726c9ca6cf41b7cea0fe.dll
Size 459KB
Sample220613-pbfwsacce8
SHA256 d09a917ded94ea7b84ddf396f1ebd58b56403f11b19bbc2fa29e35d0bdbb60fe
MD5 9e410059a2d6726c9ca6cf41b7cea0fe
SHA1 ce88133a0935861877a7b69fdb14af52c56c49a9
SHA512 d945f4eeb399089a7efbe0c3c204dcd61328d296745851d3a53a42b48a0198cd163d5a723981c5b7b1dabcf75dd2c7a63fa3ca45b8395100ecb41c9b454dfda4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1236	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1236	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1236	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1236	1680	regsvr32.exe	28
PID 1680 wrote to memory of 1236	1680	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e410059a2d6726c9ca6cf41b7cea0fe.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LqijEQxfj\vrxEcxMivsIRud.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236

memory/1680-54-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Download

memory/1680-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download