emotet | 2a08e4db0363040823a31ce89ec931ce185b8049a26fdf4ba4f1e18bf5d2d778

Analysis

Target
5221d73c0ddf4ab4b7ab33bd790b2381.dll
Size 317KB
Sample220614-tmxqwsfebk
SHA256 2a08e4db0363040823a31ce89ec931ce185b8049a26fdf4ba4f1e18bf5d2d778
MD5 5221d73c0ddf4ab4b7ab33bd790b2381
SHA1 17366eeb1dd75d90191c93502ed29d512e141f80
SHA512 167b40f5e594859e09736b5dd9cf86f687ccee3460fb8d38c7ca81dce8dacca6795f67477e0c287eacd4789c85828db8338bf4bb72fbf918b912a7fd0785d456
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3112	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 4328	3112	regsvr32.exe	79
PID 3112 wrote to memory of 4328	3112	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5221d73c0ddf4ab4b7ab33bd790b2381.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TTeqCmDn\enSFxftWXb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

memory/3112-130-0x0000000180000000-0x000000018002A000-memory.dmp

Download