emotet | cbbcd607dd0e797e9f72bc53aac7ba46c5b2b450715d626974017c769ec7aa74

Analysis

Target
d96af5968849daef9df153445c15cafd.dll
Size 558KB
Sample220615-2h8atsgce2
SHA256 cbbcd607dd0e797e9f72bc53aac7ba46c5b2b450715d626974017c769ec7aa74
MD5 d96af5968849daef9df153445c15cafd
SHA1 78ac85990792dfba3c6516403f069865daef636a
SHA512 5937bc83ad4aef013f4c8e8b6a4f88a2e0df5035f2dd880080c8166919f4b8e1e239a01f5d37155ecd8a681fe93e13d00164061d6458967d06a1e986948ced4e
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4644	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4396	4644	regsvr32.exe	80
PID 4644 wrote to memory of 4396	4644	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d96af5968849daef9df153445c15cafd.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbFaoBrSL\vUqX.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

memory/4644-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download