emotet | f417d0c535a26842a7b6592c19be55b8d576716047e1ce7bbb2daf492669e6df

Analysis

Target
1c5eea878d00a91a073905ac197c7d56.dll
Size 319KB
Sample220614-nfenvahfe4
SHA256 f417d0c535a26842a7b6592c19be55b8d576716047e1ce7bbb2daf492669e6df
MD5 1c5eea878d00a91a073905ac197c7d56
SHA1 b94fa5459661cc29b6d88e510b815ce3615c0b45
SHA512 120ffe66e41658fb334face5d2fb7d6f6b3798a1a43ac453d1b0afdde26d3b3d4559610abf4438e63cc7d123ee1a0210947947740f459335d1e189e36efc2734
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1416	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1332	1416	regsvr32.exe	27
PID 1416 wrote to memory of 1332	1416	regsvr32.exe	27
PID 1416 wrote to memory of 1332	1416	regsvr32.exe	27
PID 1416 wrote to memory of 1332	1416	regsvr32.exe	27
PID 1416 wrote to memory of 1332	1416	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c5eea878d00a91a073905ac197c7d56.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IMBmOk\ZRKeAs.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332

memory/1416-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Download

memory/1416-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download