emotet | 3dbb7d0feca3db154bd70033c3599cb9e773ebc2cdae81de87833f20eb75bc6b

Analysis

Target
1917c2fbf56fda1ec0629d6d13eed69c.dll
Size 537KB
Sample220627-17xpysdehm
SHA256 3dbb7d0feca3db154bd70033c3599cb9e773ebc2cdae81de87833f20eb75bc6b
MD5 1917c2fbf56fda1ec0629d6d13eed69c
SHA1 790f00da644ff288977c4d6cf99a55773d20c8c8
SHA512 3229e68f03c8fce46cbb5cb532f1eac9c09f07730d9fab1c2c35667c00243b6c2a5da9cef2b03ed695e6987a5fc618e9a78eb403c037b8f7a212ef0b6a9bb02e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1917c2fbf56fda1ec0629d6d13eed69c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WtXTcKKftJdQ\WtQrOfhNOay.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

memory/1964-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Download

memory/1964-55-0x0000000000320000-0x000000000034A000-memory.dmp

Download