emotet | c3aaf1d059adb9b248ffc97a7d0000985d85fc6ed74220b3dc20e8baca3044af

Analysis

Target
a23c3a85d251539eb4b0beaf5038601c.dll
Size 316KB
Sample220624-a5rstabch2
SHA256 c3aaf1d059adb9b248ffc97a7d0000985d85fc6ed74220b3dc20e8baca3044af
MD5 a23c3a85d251539eb4b0beaf5038601c
SHA1 531ab7cbfb13c327d47a506a6ddf1b3cf5c15d8e
SHA512 64d500e5cf96bb334599b1effbbd372d2fdb7ec458c9ffd939421b83c727fdf27dbd868d745b3b477bc8226f6ba231eca12ca926845ab2a8aebf87078be9455a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1272	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1660	1272	regsvr32.exe	28
PID 1272 wrote to memory of 1660	1272	regsvr32.exe	28
PID 1272 wrote to memory of 1660	1272	regsvr32.exe	28
PID 1272 wrote to memory of 1660	1272	regsvr32.exe	28
PID 1272 wrote to memory of 1660	1272	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a23c3a85d251539eb4b0beaf5038601c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UbTAQpRrUExl\Hzpfit.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

memory/1272-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Download

memory/1272-55-0x00000000005A0000-0x00000000005CB000-memory.dmp

Download