emotet | 8dfd79d96c726553cd354179e47790d0c66c63cd54aa3cedec4a7632d4e35d2f

Analysis

Target
b8cda73457a25e720ac5b56f9937fa7a.dll
Size 678KB
Sample220628-rn14labfg7
SHA256 8dfd79d96c726553cd354179e47790d0c66c63cd54aa3cedec4a7632d4e35d2f
MD5 b8cda73457a25e720ac5b56f9937fa7a
SHA1 9a1c767c2f0960e761406b65d874296529c95163
SHA512 4929e2c0ee8a354b7e46da273af40d9309b108e6a583347b34a3a713245beb2f253b207b344640ac4fa0096709ebf401fad17b8c5ccb742d439013f9f8474219
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1880	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1124	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1124	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1124	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1124	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1124	1880	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b8cda73457a25e720ac5b56f9937fa7a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YzeoyFzmfmW\fCBbqf.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

memory/1880-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/1880-55-0x0000000001D30000-0x0000000001D5B000-memory.dmp

Download