emotet | bd0a46dabef68bd017f873db9e7f5957abb83ef2c0ba7b6c468aa9d042d8cda7

Analysis

Target
7895b1b7aaa4288cda4f2553afe36b87.dll
Size 314KB
Sample220624-bxdfwsbee9
SHA256 bd0a46dabef68bd017f873db9e7f5957abb83ef2c0ba7b6c468aa9d042d8cda7
MD5 7895b1b7aaa4288cda4f2553afe36b87
SHA1 2cad47bb3d5ff1b9bd5b1fa123400ba14f12b3de
SHA512 c653a6975e99f7125c60d5dd694301304c67e3dbdebcb026d4bfebdc3c5d453948781fb924c79286d8eb7a3ee9be15b49f1f638976512160c0dd8bcc3a57e6a3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2684	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3676	2684	regsvr32.exe	82
PID 2684 wrote to memory of 3676	2684	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7895b1b7aaa4288cda4f2553afe36b87.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JtbnFjW\WlsqpGKPHE.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

memory/2684-130-0x0000000001500000-0x000000000152A000-memory.dmp

Download