emotet | 6871f70bbc626140cadeb9fb274948b3bcff40b2a3976edee809fae4fee6de02

Analysis

Target
5AtVaUWwLgI2bN60.dll
Size 314KB
Sample220624-jbjpsadee5
SHA256 6871f70bbc626140cadeb9fb274948b3bcff40b2a3976edee809fae4fee6de02
MD5 27817e480b29d5748ef99f92ea80e69d
SHA1 944a38516111335f48e5103f0e3230a778333939
SHA512 2571579d567c453ec9ececa25fea8c7116316a19fa505d944416dc8a182eae64d0b3a0f5a8ed5a779eeabeb45bca7671ce0b836ee2238e0e026aba982875461f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1992	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1180	1992	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5AtVaUWwLgI2bN60.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LPixZoTTo\VDioYxJvpmj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

memory/1992-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Download

memory/1992-55-0x00000000001F0000-0x000000000021A000-memory.dmp

Download