emotet | b85ff45eb4dc262906b309605dae172ee68e56e8d5c1d32d99cf77afa6ed6f4c

Analysis

Target
da848acce91e2a8c94bb930e54f457af.dll
Size 314KB
Sample220623-1bv69aacb8
SHA256 b85ff45eb4dc262906b309605dae172ee68e56e8d5c1d32d99cf77afa6ed6f4c
MD5 da848acce91e2a8c94bb930e54f457af
SHA1 14557bac58a55586f4c0ae2a4e61af8f640b6560
SHA512 1920f56239795a233dd9dd8b9500ee7cef107c9da8496c84908b4798896dbc50daa5e2173ef9e684706685c0d5f3512c8d1678a179c2a03d8e622d21514bae71
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
756	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2028	756	regsvr32.exe	27
PID 756 wrote to memory of 2028	756	regsvr32.exe	27
PID 756 wrote to memory of 2028	756	regsvr32.exe	27
PID 756 wrote to memory of 2028	756	regsvr32.exe	27
PID 756 wrote to memory of 2028	756	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da848acce91e2a8c94bb930e54f457af.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VnnXvnu\IsmJMiC.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

memory/756-54-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmp

Download

memory/756-55-0x0000000000440000-0x000000000046A000-memory.dmp

Download