emotet | 7865b8f97dd0cab34de461a3225c00ddfd4a4eda8a2bb6cab5b95900e52c4189

Analysis

Target
665d214cff33d7c2f2d4e40c4b56aa72.dll
Size 316KB
Sample220623-3teckagbgl
SHA256 7865b8f97dd0cab34de461a3225c00ddfd4a4eda8a2bb6cab5b95900e52c4189
MD5 665d214cff33d7c2f2d4e40c4b56aa72
SHA1 271718d75415475683a956271706e91e1f1a8957
SHA512 b8e2ff4ded21395ff4be8246dcac09dd5d6bc7468537d4bee6d13f69cc0ff04ab7b3ca90e32898ebffb7b6c37845f81961adca522245cfba6d1f4a11c41d6f61
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3172	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4420	3172	regsvr32.exe	80
PID 3172 wrote to memory of 4420	3172	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\665d214cff33d7c2f2d4e40c4b56aa72.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TNkXXleQ\DJHQ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

memory/3172-130-0x0000000000F30000-0x0000000000F5B000-memory.dmp

Download