emotet | a7250f3f79e7e327cfc7ac2aa8e375721b87e82e2eef4860b7cee26b42ce83b7

Analysis

Target
80052f996e66b21fbb57357d8d9841cb.dll
Size 308KB
Sample220621-2xte8aebfq
SHA256 a7250f3f79e7e327cfc7ac2aa8e375721b87e82e2eef4860b7cee26b42ce83b7
MD5 80052f996e66b21fbb57357d8d9841cb
SHA1 d990e35650e650c612b7d65af8e3e811e1962a7a
SHA512 4438606d48b037f96484d1c03e3465686cf6fc5e4148d468e08b05d4caa97232d9a9f49771ecfd050f961a4ff2358cc54cca045c500ee0704e43faf6ca4bc4b6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5048	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5096	5048	regsvr32.exe	80
PID 5048 wrote to memory of 5096	5048	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\80052f996e66b21fbb57357d8d9841cb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SvPVduVF\FyCVBWPdhwkuToJ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

memory/5048-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download