emotet | eb45f3e3ba52318ac50f6b72d1d9c4952231ab70eff855d40bb0138d8eeecee5

Analysis

Target
9cd4d765aed24005623202643254215b.dll
Size 416KB
Sample220615-back3sdddl
SHA256 eb45f3e3ba52318ac50f6b72d1d9c4952231ab70eff855d40bb0138d8eeecee5
MD5 9cd4d765aed24005623202643254215b
SHA1 2a1942dd0d4d1ea9e4f29fd2e5782fb8b1223104
SHA512 458aafdfae588f2b37c48c580db0113a8781c4078d711851aeb776fc3f2830cb2af45a1f209732813a93f66b8ddf44e7a71fccb1bf498cddc26db27378479368
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1884	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2032	1884	regsvr32.exe	28
PID 1884 wrote to memory of 2032	1884	regsvr32.exe	28
PID 1884 wrote to memory of 2032	1884	regsvr32.exe	28
PID 1884 wrote to memory of 2032	1884	regsvr32.exe	28
PID 1884 wrote to memory of 2032	1884	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9cd4d765aed24005623202643254215b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IhBIRPObFfTCaJi\fiMwZiKbTPU.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

memory/1884-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Download

memory/1884-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download