emotet | adcf38ff65746c16d4532b9ee07bcb553d5df185afc1214f89628655d50b9f30

Analysis

Target
e9d243621db741a440cb2c3837975438.dll
Size 459KB
Sample220613-vt958sdhd2
SHA256 adcf38ff65746c16d4532b9ee07bcb553d5df185afc1214f89628655d50b9f30
MD5 e9d243621db741a440cb2c3837975438
SHA1 83c618270836dc75541ef13ac1b2f1deb0879b8a
SHA512 db6b1d424528fb7972d9ec3e3213be0738439c04cbc1adb7bc563db5220db6b2697410075cb2d8437d1093396c3bf656f02f00a6e095dd7aa8c4046502fcfdb7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1160	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 948	1160	regsvr32.exe	28
PID 1160 wrote to memory of 948	1160	regsvr32.exe	28
PID 1160 wrote to memory of 948	1160	regsvr32.exe	28
PID 1160 wrote to memory of 948	1160	regsvr32.exe	28
PID 1160 wrote to memory of 948	1160	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e9d243621db741a440cb2c3837975438.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OnsJeJmJULfB\xfqZLl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

memory/1160-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Download

memory/1160-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download