emotet | f79ce15686ea694c2b9bdf05938b64d43ec3d32b28fc17afebadf7acdf38ecb2

Analysis

Target
1099b9b40d3a96f0b163a787de063d30.dll
Size 319KB
Sample220614-spk97sbbc3
SHA256 f79ce15686ea694c2b9bdf05938b64d43ec3d32b28fc17afebadf7acdf38ecb2
MD5 1099b9b40d3a96f0b163a787de063d30
SHA1 68caeab5df39697f17854dadef550c3be4559ca3
SHA512 cac4734a002e20e5bdb36d5ac436db6bd5de617f8388162283e371738e84cc7cd443c11802c3be73662ef77fc53c5b9598852ee015f550d70a45cdd2b529c62d
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
624	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 892	624	regsvr32.exe	28
PID 624 wrote to memory of 892	624	regsvr32.exe	28
PID 624 wrote to memory of 892	624	regsvr32.exe	28
PID 624 wrote to memory of 892	624	regsvr32.exe	28
PID 624 wrote to memory of 892	624	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1099b9b40d3a96f0b163a787de063d30.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WvgsNIbVKT\CScTWueCubod.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892

memory/624-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Download

memory/624-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download