emotet | d58cecca57116d0e5bff55bdf30a6d798148decfe079e1a3949a7c8b6cfa9a8b

Analysis

Target
a370eeae706258b9d436efb45408c831.dll
Size 463KB
Sample220613-v3pkwsdhh9
SHA256 d58cecca57116d0e5bff55bdf30a6d798148decfe079e1a3949a7c8b6cfa9a8b
MD5 a370eeae706258b9d436efb45408c831
SHA1 fdfdaa412905a8de758c5f83d43a95e3f67b1b61
SHA512 46f34b5c4ebb9c0ffc947f116a9143d8b1b0768ae698af4d9345e380af8503e4328daf6d7c0152c3b00196aac0765a46cc77333808a3db38c0ead47e5891faaf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4284	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4384	4284	regsvr32.exe	79
PID 4284 wrote to memory of 4384	4284	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a370eeae706258b9d436efb45408c831.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DdTKMJGPUhblenu\IntTP.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

memory/4284-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download