emotet | 3de8a6425a5c795d8f738135c0f86ee882e02c19bf1f447f11a596dd1cd26749

Analysis

Target
19a798a1f99b08f974983c59ebf89ce4.dll
Size 319KB
Sample220614-spk97sfaer
SHA256 3de8a6425a5c795d8f738135c0f86ee882e02c19bf1f447f11a596dd1cd26749
MD5 19a798a1f99b08f974983c59ebf89ce4
SHA1 774e551928e44a74d350a0cdc4358c76ef83b5cb
SHA512 118e3df14e33a5bc33e69831c0e9acf6dada9cace6239b4bd6a93ec912b2afba46ce7461fd4cb8b9ca9299eebb212984f3fb3fdc3fe716df1c75beed528a015c
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1100	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1484	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1484	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1484	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1484	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1484	1100	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\19a798a1f99b08f974983c59ebf89ce4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DKfubRagvzh\Lkfw.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

memory/1100-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download

memory/1100-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download