emotet | dca1e499d4622bddfbd5718465c610c0d90acece5afffe224ade0e249fe78e75

Analysis

Target
39b45e0fb5110f14eb64d0732b226756.dll
Size 416KB
Sample220615-b74qtsbdh8
SHA256 dca1e499d4622bddfbd5718465c610c0d90acece5afffe224ade0e249fe78e75
MD5 39b45e0fb5110f14eb64d0732b226756
SHA1 b166041426ae12611cb0951b74b65c5aa6763080
SHA512 55392c6d87db82f26d5a9ab8f1b108671ba3fa8917705fac67f9b1242fc8346be0400455a495796a1e1840f4f1dee22e7a6b29a59b585b5c501bee2ea422d88f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4208	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3432	4208	regsvr32.exe	79
PID 4208 wrote to memory of 3432	4208	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39b45e0fb5110f14eb64d0732b226756.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EYXkFoyJnETU\HFPFiCXWUenhxr.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432

memory/4208-130-0x0000000180000000-0x000000018002A000-memory.dmp

Download