emotet | bd0a46dabef68bd017f873db9e7f5957abb83ef2c0ba7b6c468aa9d042d8cda7

Analysis

Target
7895b1b7aaa4288cda4f2553afe36b87.dll
Size 314KB
Sample220624-bxdfwsbee9
SHA256 bd0a46dabef68bd017f873db9e7f5957abb83ef2c0ba7b6c468aa9d042d8cda7
MD5 7895b1b7aaa4288cda4f2553afe36b87
SHA1 2cad47bb3d5ff1b9bd5b1fa123400ba14f12b3de
SHA512 c653a6975e99f7125c60d5dd694301304c67e3dbdebcb026d4bfebdc3c5d453948781fb924c79286d8eb7a3ee9be15b49f1f638976512160c0dd8bcc3a57e6a3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
784	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1528	784	regsvr32.exe	27
PID 784 wrote to memory of 1528	784	regsvr32.exe	27
PID 784 wrote to memory of 1528	784	regsvr32.exe	27
PID 784 wrote to memory of 1528	784	regsvr32.exe	27
PID 784 wrote to memory of 1528	784	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7895b1b7aaa4288cda4f2553afe36b87.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GXBcpbXGWOqww\anjyHUWtaAAzYX.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

memory/784-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Download

memory/784-55-0x0000000001D50000-0x0000000001D7A000-memory.dmp

Download