emotet | f1ba6db9a1615580f2fd996e590c5dcedd97494a8dfc5f591c4e2ced7d7e1261

Analysis

Target
triage_dropped_file.dll
Size 559KB
Sample220629-1dletsehb4
SHA256 f1ba6db9a1615580f2fd996e590c5dcedd97494a8dfc5f591c4e2ced7d7e1261
MD5 4454f726fb665d46f1c6a23dbefdf888
SHA1 5f5636b2feb1c9e88f7a5af10ecda7f66cc8655f
SHA512 caf0f37278ae3950fb79df57189b76af06ebddf48717ad8446335a118e3b1d38c51a3b3bd0fb9ee158dc36a816cf874da839d07658979ed24f7564e467c26eeb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1948	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1204	1948	regsvr32.exe	28
PID 1948 wrote to memory of 1204	1948	regsvr32.exe	28
PID 1948 wrote to memory of 1204	1948	regsvr32.exe	28
PID 1948 wrote to memory of 1204	1948	regsvr32.exe	28
PID 1948 wrote to memory of 1204	1948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RUbNeIbjQ\yZbJpjYUyQRFUD.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204

memory/1948-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Download

memory/1948-55-0x00000000005F0000-0x000000000061A000-memory.dmp

Download