emotet | 9e8cf94b7fefec7f86fbf5e2613a71faacddf76afc50f56a077d4af8873bfa7c

Analysis

Target
7e5689208d1df14c4a2927602dd16a1e.dll
Size 416KB
Sample220615-a6b4rahcb6
SHA256 9e8cf94b7fefec7f86fbf5e2613a71faacddf76afc50f56a077d4af8873bfa7c
MD5 7e5689208d1df14c4a2927602dd16a1e
SHA1 028e78936a6ae3e641de964d359b590008427829
SHA512 b0f5fe87b55c3db4e84b4798f794e007a2943e5522fe9bff1d4da4c8c2863fbeb5a80307526554ebf86d99b62879e632904774f6b7c1985a5741947eefc60357
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1472	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1956	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1956	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1956	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1956	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1956	1472	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e5689208d1df14c4a2927602dd16a1e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NaHfslarMpTRt\JiEiA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

memory/1472-54-0x000007FEFB971000-0x000007FEFB973000-memory.dmp

Download

memory/1472-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download