emotet | b85ff45eb4dc262906b309605dae172ee68e56e8d5c1d32d99cf77afa6ed6f4c

Analysis

Target
da848acce91e2a8c94bb930e54f457af.dll
Size 314KB
Sample220623-1bv69aacb8
SHA256 b85ff45eb4dc262906b309605dae172ee68e56e8d5c1d32d99cf77afa6ed6f4c
MD5 da848acce91e2a8c94bb930e54f457af
SHA1 14557bac58a55586f4c0ae2a4e61af8f640b6560
SHA512 1920f56239795a233dd9dd8b9500ee7cef107c9da8496c84908b4798896dbc50daa5e2173ef9e684706685c0d5f3512c8d1678a179c2a03d8e622d21514bae71
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5108	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2116	5108	regsvr32.exe	80
PID 5108 wrote to memory of 2116	5108	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da848acce91e2a8c94bb930e54f457af.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FItcjQOWZVxpF\WGcvzThhbInLQva.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116

memory/5108-130-0x0000000002820000-0x000000000284A000-memory.dmp

Download