emotet | f874d44d953146827e6f2d8190bc7bba5b9ae845da5e69bd0a4bad7d460646de

Analysis

Target
88033d74e118e74155688e17f4e1c178.dll
Size 463KB
Sample220613-xcbmfsaaep
SHA256 f874d44d953146827e6f2d8190bc7bba5b9ae845da5e69bd0a4bad7d460646de
MD5 88033d74e118e74155688e17f4e1c178
SHA1 2014f9ca1181b36d5806afeb065ba836e0df666b
SHA512 a1c1ec741dd59b36ad6c460f21e8325f7db3985b1a4a67da60edc6fde2b4c4fd36b6568818ca2549d27f1f1058b256e88542e17408866eeff1ab2c62a641b89c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1772	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1772	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1772	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1772	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1772	2020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88033d74e118e74155688e17f4e1c178.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QSXPYDYCBVZ\eFQTUZUrl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772

memory/2020-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download

memory/2020-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download