emotet | d9ea4bdf8c7cb6781c6c7a7001ba189838865a895488cffa5ccc8e32cd8c4413

Analysis

Target
8691bee93608dc0685ee102550092ee5.dll
Size 408KB
Sample220615-ldlchadaaq
SHA256 d9ea4bdf8c7cb6781c6c7a7001ba189838865a895488cffa5ccc8e32cd8c4413
MD5 8691bee93608dc0685ee102550092ee5
SHA1 407313276521d8468a3c7a65f00f74a2f49fb2c1
SHA512 6f99178c73e4246443ba77e0989136e7c2d31ab9b086c8bd56dcf3f172ef66e131eb7fe9d5359d3e5e2757d92c8784c1da487aeb6304140efaa35ef35ba0e9aa
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1552	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 276	1552	regsvr32.exe	26
PID 1552 wrote to memory of 276	1552	regsvr32.exe	26
PID 1552 wrote to memory of 276	1552	regsvr32.exe	26
PID 1552 wrote to memory of 276	1552	regsvr32.exe	26
PID 1552 wrote to memory of 276	1552	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8691bee93608dc0685ee102550092ee5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OHxozhHyanVB\WxobYTWq.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:276

memory/1552-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download

memory/1552-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download