emotet | 44c140e4e5f59a3c665990613dd50af9d944efc879bb07d2219eb77c49b15606

Analysis

Target
416ecd375cc1975891f3706adccf04a3.dll
Size 559KB
Sample220629-yn8l1acdhl
SHA256 44c140e4e5f59a3c665990613dd50af9d944efc879bb07d2219eb77c49b15606
MD5 416ecd375cc1975891f3706adccf04a3
SHA1 5007dab44885e6eef5abe37d964ca56b12319950
SHA512 16f2f8e077004b0512f5e85932d53033a027a201361fbb02c4e104feb833a7a6ad05ecc48a312fcfa19532a85d70895cb8b2cca52f7fd0724b4d7085ab54d130
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3372	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3432	3372	regsvr32.exe	81
PID 3372 wrote to memory of 3432	3372	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\416ecd375cc1975891f3706adccf04a3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XsPGVmRwGGfArGM\ZqeoBFjbiHc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432

memory/3372-130-0x0000000002840000-0x000000000286A000-memory.dmp

Download