emotet | ab74499fe722118672a799b25b00cb22d0b70872cf2e5af4fe63cd3a7b0fab65

Analysis

Target
f7d5010d0e830dd3ad9b0edb74646b67.dll
Size 676KB
Sample220628-tdcdlaaegm
SHA256 ab74499fe722118672a799b25b00cb22d0b70872cf2e5af4fe63cd3a7b0fab65
MD5 f7d5010d0e830dd3ad9b0edb74646b67
SHA1 94029f48c2a97c3bdba603b7027d0a17a496e45d
SHA512 27aa72621345b05300f3ad86e4f3fc2b3014ed66f4dcf523a2e6656efc526d68aac48122632dc2c32de4a806f8e725b6133e51061617fa313f70f0cd96737b3d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1928	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1672	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1672	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1672	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1672	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1672	1928	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7d5010d0e830dd3ad9b0edb74646b67.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KRXwH\gNNHL.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672

memory/1928-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download

memory/1928-55-0x00000000001E0000-0x000000000020A000-memory.dmp

Download