emotet | c66e6a45dee2a8b16e4aaabd32a71b6a0b88d3d97765e60b0e0247faae6f975c

Analysis

Target
d8bfaff09f2c9aede378f5796e4fbec4.dll
Size 308KB
Sample220621-1hlldsdfdk
SHA256 c66e6a45dee2a8b16e4aaabd32a71b6a0b88d3d97765e60b0e0247faae6f975c
MD5 d8bfaff09f2c9aede378f5796e4fbec4
SHA1 cb37beeadfc858ecf4a4fc09bf846d6915a59525
SHA512 1ac222d3114fad5d1770dccfe92ea5308bf2f7b294da7e81feed9e7ac7a0d6e9d456ca0f23ec36f937795ea67f580fcb835ff97995492c777ed2cf8c91fa2f8f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1668	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1356	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1356	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1356	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1356	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1356	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d8bfaff09f2c9aede378f5796e4fbec4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IyswmhUZ\iPDzvjlmxlHI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

memory/1668-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/1668-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download