emotet | 71ebc1abc621b7eba9dda2af7dce76a59907e717b6f39844819688345692d4c1

Analysis

Target
9af70ab15b1505289235a0a5bdbe80b4.dll
Size 558KB
Sample220615-2hnanagcd4
SHA256 71ebc1abc621b7eba9dda2af7dce76a59907e717b6f39844819688345692d4c1
MD5 9af70ab15b1505289235a0a5bdbe80b4
SHA1 4783f36f2c797486966e107d1b0e4d7f9f8746eb
SHA512 cc968c156d03fa0e78c1a5885e6baa89a45d80574bba1efd172dff3eed0a037811592366283fd39ddec51009fb230e42379493a35a9c71f5c9d678ddf3efad75
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4472	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 5024	4472	regsvr32.exe	81
PID 4472 wrote to memory of 5024	4472	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9af70ab15b1505289235a0a5bdbe80b4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YLEWPYqxwCezrm\ALfdVPcvLVE.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024

memory/4472-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download