emotet | 95aef5810b5f92fc4493d6f9d2c4f92cf43488b5c17540d0cfc70a5f99d2fc79

Analysis

Target
532db5186a66a7f788308cf12c236de7.dll
Size 319KB
Sample220614-spk97sbbc5
SHA256 95aef5810b5f92fc4493d6f9d2c4f92cf43488b5c17540d0cfc70a5f99d2fc79
MD5 532db5186a66a7f788308cf12c236de7
SHA1 1c5d918653d7a0af6703ebc8a2de3015fa7afaa9
SHA512 02be0633e2cd684fbf5aea7e84ef13665c604f00bd4a8922f4a645a27ca36174ec7e48eb03fd43937ff824b6b590c06e3a1201b0a73df0b7416f93954f64bb59
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3844	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 5000	3844	regsvr32.exe	78
PID 3844 wrote to memory of 5000	3844	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\532db5186a66a7f788308cf12c236de7.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MOnUCaSyOsJxUCQ\PQwHxOWuloDg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

memory/3844-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download