emotet | f2c95613ee71ba3244816ea7353e09cd6a0b3232eb9aff7179737e14ad3689aa

Analysis

Target
38a33ea518bb4370e681f8a32b11ef60.dll
Size 416KB
Sample220615-mesnmsgcg6
SHA256 f2c95613ee71ba3244816ea7353e09cd6a0b3232eb9aff7179737e14ad3689aa
MD5 38a33ea518bb4370e681f8a32b11ef60
SHA1 3f50b264a28a70c5ee6d30088ac409f58528a6a3
SHA512 f6485fc19fe516c9064c382a9ad75f609ca933da4d5c63d01694563707714428287a99e9affb2569fd5b1d4c70ce261992d7e379e2ad7d5eff79e18ce92d31a4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 5068	1620	regsvr32.exe	79
PID 1620 wrote to memory of 5068	1620	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\38a33ea518bb4370e681f8a32b11ef60.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DoAzFjUSWICyVe\ZiHjtxVwwXWNTx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068

memory/1620-130-0x0000000180000000-0x000000018002A000-memory.dmp

Download