emotet | d8f5a509c04e6d3aa303945782bcb2f02e93f8c93ed720429e9df2df51689c3d

Analysis

Target
ac4d0a334e4a07962c48aa24b935cb82.dll
Size 417KB
Sample220615-a6b4radbcj
SHA256 d8f5a509c04e6d3aa303945782bcb2f02e93f8c93ed720429e9df2df51689c3d
MD5 ac4d0a334e4a07962c48aa24b935cb82
SHA1 45aa177100ac41bc42b95392ba9876de79795299
SHA512 ddca839d5080f083545420caf3178022e18e832c3ed415818f770284325091ab28a0a6812ac9f105c8d3c4ecd0cb21f8ff19bee6dd7af060b0865a490c43927d
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1492	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1128	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1128	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1128	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1128	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1128	1492	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac4d0a334e4a07962c48aa24b935cb82.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XCdjKwXctgZyw\rvWwwhNXGmc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

memory/1492-54-0x000007FEFB7C1000-0x000007FEFB7C3000-memory.dmp

Download

memory/1492-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download