emotet | 3dbb7d0feca3db154bd70033c3599cb9e773ebc2cdae81de87833f20eb75bc6b

Analysis

Target
1917c2fbf56fda1ec0629d6d13eed69c.dll
Size 537KB
Sample220627-17xpysdehm
SHA256 3dbb7d0feca3db154bd70033c3599cb9e773ebc2cdae81de87833f20eb75bc6b
MD5 1917c2fbf56fda1ec0629d6d13eed69c
SHA1 790f00da644ff288977c4d6cf99a55773d20c8c8
SHA512 3229e68f03c8fce46cbb5cb532f1eac9c09f07730d9fab1c2c35667c00243b6c2a5da9cef2b03ed695e6987a5fc618e9a78eb403c037b8f7a212ef0b6a9bb02e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4988	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1276	4988	regsvr32.exe	82
PID 4988 wrote to memory of 1276	4988	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1917c2fbf56fda1ec0629d6d13eed69c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RGxGyiE\ezgDxKEBVb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276

memory/4988-130-0x0000000002530000-0x000000000255A000-memory.dmp

Download