emotet | 425b5d979941812fa37f17ac3308c0773770bf72dcbb764e6a5f68c338ce65e6

Analysis

Target
163817240824cc95c8d6a9bdbcd4b68f.dll
Size 669KB
Sample220624-tng2tsgbb2
SHA256 425b5d979941812fa37f17ac3308c0773770bf72dcbb764e6a5f68c338ce65e6
MD5 163817240824cc95c8d6a9bdbcd4b68f
SHA1 8d1fb289679df07c6c61807d9ff75c464252f921
SHA512 bbaa6fe0ecb8096553d6d8b407f2a1b0ee884931c7ecd4d6507206ba2251b8e9106dd22031be05e6b6eaf89542ab46e755e0d091bf03adb841011a63aaff0d50
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3216	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4688	3216	regsvr32.exe	84
PID 3216 wrote to memory of 4688	3216	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\163817240824cc95c8d6a9bdbcd4b68f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZRlipUP\BFhnKSKqs.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

memory/3216-130-0x0000000002B40000-0x0000000002B6B000-memory.dmp

Download