emotet | ad04d1908484ac561aaed4432ee7eb033bae78efeb6883e4b1a31cff6935dfd5

Analysis

Target
9042a353cbbd11992a810c2c20a6c630.dll
Size 705KB
Sample220617-b339hacec2
SHA256 ad04d1908484ac561aaed4432ee7eb033bae78efeb6883e4b1a31cff6935dfd5
MD5 9042a353cbbd11992a810c2c20a6c630
SHA1 3858e09082c1fdd62735ad3e9faf72f8ebe7bd8c
SHA512 4f77a8d3d6175b538136c1497cfb435b0b9f21bad17d091e32cee6bc4b0a2fab948f6bb0f1b56f221bc48b1ad4ff2467f18749670314fbb41d8511cb5424e74b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1056	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1332	1056	regsvr32.exe	27
PID 1056 wrote to memory of 1332	1056	regsvr32.exe	27
PID 1056 wrote to memory of 1332	1056	regsvr32.exe	27
PID 1056 wrote to memory of 1332	1056	regsvr32.exe	27
PID 1056 wrote to memory of 1332	1056	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9042a353cbbd11992a810c2c20a6c630.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IMBmOk\ZRKeAs.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332

memory/1056-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Download

memory/1056-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download