emotet | 03d947ab0ea9aed2c22e2e8fbdd129ac694cdab71dabc20f14acfabe04255f59

Analysis

Target
ff92cfd3c6dfd16083f57e29671634f8.dll
Size 670KB
Sample220628-p3gmdshebr
SHA256 03d947ab0ea9aed2c22e2e8fbdd129ac694cdab71dabc20f14acfabe04255f59
MD5 ff92cfd3c6dfd16083f57e29671634f8
SHA1 8adc5e10539886950b4d4506fafc161ed8884d23
SHA512 a860b5f16a228e0da4e8abd4b09359d68667ae341f0d82d9fb0ca4e72b641e074700fc2fb9d2e23ef431a2b3d94310402f4f21021e7f233753d350f1f2577acc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2788	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4932	2788	regsvr32.exe	81
PID 2788 wrote to memory of 4932	2788	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff92cfd3c6dfd16083f57e29671634f8.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AhtfvUlGwOBwXt\eGKPKdxwiHp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

memory/2788-130-0x0000000000CF0000-0x0000000000D1B000-memory.dmp

Download