emotet | a051d201dc87b9301f98bd53de834d111e0d9d7edc325331ed75f1f3a5ef24fd

Analysis

Target
U0iQQGKsQEb.dll
Size 308KB
Sample220621-tkmg5saaa7
SHA256 a051d201dc87b9301f98bd53de834d111e0d9d7edc325331ed75f1f3a5ef24fd
MD5 a47e5bdd1fc2ded9608c9c627ab2d47d
SHA1 95962c0a49e35bf19b946d989eec3bc4d8c38df0
SHA512 853fd6eaf1601dd84425d2a5c80db4d02af65c2396792f371cf5342c6bfa326fa3048eca60875fdfa8f6d18f9625beba811b2c86e336546e139323c10e57760e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2036	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1944	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1944	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1944	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1944	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1944	2036	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\U0iQQGKsQEb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IBRQQlTAYwhS\aiXkWg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

memory/2036-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Download

memory/2036-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download