emotet | 7f922dff8c2d04178fdf26842066d322abcb1a31a2b5fae24c33df518de95dc6

Analysis

Target
bd01c7c66641897191c6e8efb18b8846.dll
Size 264KB
Sample220614-x5hapshdhl
SHA256 7f922dff8c2d04178fdf26842066d322abcb1a31a2b5fae24c33df518de95dc6
MD5 bd01c7c66641897191c6e8efb18b8846
SHA1 299ae383afd6771996f01cd77e77454093ff10c9
SHA512 167968987e00442bc4b5c2a3e44bf226a1f84885440ff7085ec89b164fd3db7d8ddbbcb3b5f1c630eb2a8429279923d5882429db65697ea14eb55f77bb22db85
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1100	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1728	1100	regsvr32.exe	26
PID 1100 wrote to memory of 1728	1100	regsvr32.exe	26
PID 1100 wrote to memory of 1728	1100	regsvr32.exe	26
PID 1100 wrote to memory of 1728	1100	regsvr32.exe	26
PID 1100 wrote to memory of 1728	1100	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bd01c7c66641897191c6e8efb18b8846.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SqzddLwtGkfZaV\JltaTHll.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

memory/1100-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download

memory/1100-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download