emotet | f59cb065017b2df950b8bc2368d73618127361c08406d4dd688d2f5cd5601f10

Analysis

Target
1db24473c839438067f73d4e1d5cee37.dll
Size 558KB
Sample220616-c35yrsgbbq
SHA256 f59cb065017b2df950b8bc2368d73618127361c08406d4dd688d2f5cd5601f10
MD5 1db24473c839438067f73d4e1d5cee37
SHA1 875853fb8e99aa2b5341d44201d28445ecbbe56a
SHA512 a339f991d1d7916d1764ce874535b9471efce9cd132d7080269a411cfeeb467d01b0645457bcc82acc29a17bf6dafa34d5e91a02844a0346a20f5731655356f0
MD5 SHA1 SHA512

Score

10^/10

Family

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
904	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4380	904	regsvr32.exe	81
PID 904 wrote to memory of 4380	904	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1db24473c839438067f73d4e1d5cee37.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HBdPQHjLsj\tRjVn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380

memory/904-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download