emotet | ad04d1908484ac561aaed4432ee7eb033bae78efeb6883e4b1a31cff6935dfd5

Analysis

Target
9042a353cbbd11992a810c2c20a6c630.dll
Size 705KB
Sample220617-b339hacec2
SHA256 ad04d1908484ac561aaed4432ee7eb033bae78efeb6883e4b1a31cff6935dfd5
MD5 9042a353cbbd11992a810c2c20a6c630
SHA1 3858e09082c1fdd62735ad3e9faf72f8ebe7bd8c
SHA512 4f77a8d3d6175b538136c1497cfb435b0b9f21bad17d091e32cee6bc4b0a2fab948f6bb0f1b56f221bc48b1ad4ff2467f18749670314fbb41d8511cb5424e74b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3516	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3412	3516	regsvr32.exe	78
PID 3516 wrote to memory of 3412	3516	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9042a353cbbd11992a810c2c20a6c630.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GqFNLfeJ\TyQyGIS.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412

memory/3516-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download