emotet | 1c2415c1ec7c9e78d52d73b9df60964ab2291130b18eb2b016caef18430e231d

Analysis

Target
f3c65fffa61a2e537451d0e8f1262ab9.dll
Size 559KB
Sample220629-ysnsdsecf6
SHA256 1c2415c1ec7c9e78d52d73b9df60964ab2291130b18eb2b016caef18430e231d
MD5 f3c65fffa61a2e537451d0e8f1262ab9
SHA1 37feef2de9e1f6d88267c05c1028d54f804a064b
SHA512 d228c2aed71316c6d8537f7132ec1f9e9580d1dd9d9053cd199e19c518588a9b053659fe9d9feb10bdf4cc8de022f8825721859fd7faf6a5e6ca9cf5ec031dda
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2804	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3568	2804	regsvr32.exe	81
PID 2804 wrote to memory of 3568	2804	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3c65fffa61a2e537451d0e8f1262ab9.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AbAyUPqnZ\xANshCfLWxtgnd.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

memory/2804-130-0x0000000002CE0000-0x0000000002D0A000-memory.dmp

Download