emotet | 3d97c4fde7c8566c062caabd41b9f3f9be1a6adfa8739ef13b5950c66eef9245

Analysis

Target
d77287cfc03636a4189014b789475076.dll
Size 537KB
Sample220629-a73cbsdfcn
SHA256 3d97c4fde7c8566c062caabd41b9f3f9be1a6adfa8739ef13b5950c66eef9245
MD5 d77287cfc03636a4189014b789475076
SHA1 21ad1b2bfd87e19e93b0164f4ff999b96b3f53b7
SHA512 c329b803ab864fa090f04f87f45a87b96a821ef04046ca873228d0372870e18510e98ae187563c47b2713e60fee2453f4e5d815175dec441e0fab72db78c9e52
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
664	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2044	664	regsvr32.exe	28
PID 664 wrote to memory of 2044	664	regsvr32.exe	28
PID 664 wrote to memory of 2044	664	regsvr32.exe	28
PID 664 wrote to memory of 2044	664	regsvr32.exe	28
PID 664 wrote to memory of 2044	664	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d77287cfc03636a4189014b789475076.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VuCIiMCjJwGE\IogXf.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

memory/664-54-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Download

memory/664-55-0x0000000000570000-0x000000000059A000-memory.dmp

Download