emotet | 6772ab130c8bdcd06ba37187039c2b095814a88f8fce35c4c278ebd68704ce6a

Analysis

Target
22d883417134b03d84688c1afca3fdb6.dll
Size 676KB
Sample220629-qws8aabeg3
SHA256 6772ab130c8bdcd06ba37187039c2b095814a88f8fce35c4c278ebd68704ce6a
MD5 22d883417134b03d84688c1afca3fdb6
SHA1 c485809d6220f85a67bf82c929c4bcd3ef4ac351
SHA512 996e467ec8299dfb6d3c3f995926d91aa7055a0069146d7d101566d6699cf5d2732cf128daf722d89e021e4e49c64338325ad757de65951927a966f034866ae7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1648	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1408	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1408	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1408	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1408	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1408	1648	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\22d883417134b03d84688c1afca3fdb6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MkEnXeISKrGQSih\epDCBjCxRpfSd.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408

memory/1648-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Download

memory/1648-55-0x0000000000510000-0x000000000053B000-memory.dmp

Download