emotet | adbee892eaad68ffd6da1d32a8018c9ee004fdc1c451d802ed951651d7571a27

Analysis

Target
6665ddaa6bc720dfd89a8b62f63959dc.dll
Size 425KB
Sample220630-bc7t1agch8
SHA256 adbee892eaad68ffd6da1d32a8018c9ee004fdc1c451d802ed951651d7571a27
MD5 6665ddaa6bc720dfd89a8b62f63959dc
SHA1 befdf423706ec63fc29f6f61a095bc91fd7de0ad
SHA512 759e512bd054b24f2d9782ee7a76ee89ff6cec0771928d3804a8fcd52529f501e93efdf39eeca82f0ab76c3283c4d90448151b2736005e2b57c8629703fb3941
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
868	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1128	868	regsvr32.exe	28
PID 868 wrote to memory of 1128	868	regsvr32.exe	28
PID 868 wrote to memory of 1128	868	regsvr32.exe	28
PID 868 wrote to memory of 1128	868	regsvr32.exe	28
PID 868 wrote to memory of 1128	868	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6665ddaa6bc720dfd89a8b62f63959dc.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BJmKxAINGTOMXWnk\mysuxlihLrHl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

memory/868-54-0x000007FEFC041000-0x000007FEFC043000-memory.dmp

Download

memory/868-55-0x0000000000320000-0x0000000000374000-memory.dmp

Download