emotet | c22aa84ea62b0a296bc91bc2c38c75c614048a9f6f010f203b774aec774dc49b

Analysis

Target
c156cfb85e0ca7c37cd2274450b3b5c8.dll
Size 676KB
Sample220628-sjfsjacac8
SHA256 c22aa84ea62b0a296bc91bc2c38c75c614048a9f6f010f203b774aec774dc49b
MD5 c156cfb85e0ca7c37cd2274450b3b5c8
SHA1 047cec147a8ebc7248022b256c5c5c3d4aa30470
SHA512 3e8c703463069698a43430cc28c45932d0470d8e39ad11e9d3d14bb4ca417dddce7aca99570cd066658886cad28aac6a373c12640d0bc6eaf088fa6cd00aead3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
272	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 840	272	regsvr32.exe	28
PID 272 wrote to memory of 840	272	regsvr32.exe	28
PID 272 wrote to memory of 840	272	regsvr32.exe	28
PID 272 wrote to memory of 840	272	regsvr32.exe	28
PID 272 wrote to memory of 840	272	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c156cfb85e0ca7c37cd2274450b3b5c8.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ClfmewhVND\BXATMdiGWbG.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840

memory/272-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download

memory/272-55-0x00000000002E0000-0x000000000030A000-memory.dmp

Download