emotet | ff84cfaf1f15f3fbe538b8dc77ce41f1248bcab7d422dff81bc11bf355444492

Analysis

Target
2a094ffc95f54713862d653f1fcdc3fe.dll
Size 425KB
Sample220630-c61hfsfbbl
SHA256 ff84cfaf1f15f3fbe538b8dc77ce41f1248bcab7d422dff81bc11bf355444492
MD5 2a094ffc95f54713862d653f1fcdc3fe
SHA1 adb152e0a27aab83c0c151351bcea01578ed3450
SHA512 63331b8c451077b3e0999372dca73307e5a5c3ab5c6ab1d0fa5069846d413667034d7d6060da593ae52c15a4fbda34b3737562a781b22190039e548e0dc98134
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
8	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4876	8	regsvr32.exe	81
PID 8 wrote to memory of 4876	8	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2a094ffc95f54713862d653f1fcdc3fe.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZezHgWYjVA\shkBbx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876

memory/8-130-0x0000000001FC0000-0x0000000002014000-memory.dmp

Download