emotet | bee7de7f33f0250e2bda0c2597ed108ed10cad70b06b7d9d8d36be5c729c911c

Analysis

Target
5be697875c59f9471239f83803fa9721.dll
Size 317KB
Sample220614-rxexqaefhp
SHA256 bee7de7f33f0250e2bda0c2597ed108ed10cad70b06b7d9d8d36be5c729c911c
MD5 5be697875c59f9471239f83803fa9721
SHA1 ec83bdd4ba16c9576610598badec64c0b0d24c1a
SHA512 fe431fd6467c6d104ad8ff319a2538a4cf58cb35dc142626ab7df7125c97d8c4681ad752c8a834a76dc46a3360406a13dd33aa840bbc39044120a408ae466beb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1188	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 5064	1188	regsvr32.exe	77
PID 1188 wrote to memory of 5064	1188	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5be697875c59f9471239f83803fa9721.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DnvrnfHvqldv\WpiZVp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064

memory/1188-130-0x0000000180000000-0x000000018002A000-memory.dmp

Download