emotet | a94e6bc185df8b8d63537be25f7c253312781a98fb88c5304db52d13a00a290c

Analysis

Target
12405d3f19a1bfd5a9efade7e303266a.dll
Size 705KB
Sample220617-baxw1shhap
SHA256 a94e6bc185df8b8d63537be25f7c253312781a98fb88c5304db52d13a00a290c
MD5 12405d3f19a1bfd5a9efade7e303266a
SHA1 5eb4e70602143a257c2e5340f3875ea5ee5e343a
SHA512 9cc22308a5cba2f40ea99d03ec32ff15ac5284d48c8dbe4d2c85fab0ed91101185960a6c74c79fa0d0d1a1fdad01c7c4cbfc57d60894c6f7986d1181c7e2f1a6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1624	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 956	1624	regsvr32.exe	27
PID 1624 wrote to memory of 956	1624	regsvr32.exe	27
PID 1624 wrote to memory of 956	1624	regsvr32.exe	27
PID 1624 wrote to memory of 956	1624	regsvr32.exe	27
PID 1624 wrote to memory of 956	1624	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\12405d3f19a1bfd5a9efade7e303266a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TDjIuPUZoceoY\DZDpDzkZZMyiEt.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956

memory/1624-54-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Download

memory/1624-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download