emotet | e9a2f199e5216f76af82c072b741f5abd9a1972ca3c47fce766fd91dac6bd258

Analysis

Target
39daff21adab62238ae07bdd9930ae24.dll
Size 423KB
Sample220630-c61hfshae2
SHA256 e9a2f199e5216f76af82c072b741f5abd9a1972ca3c47fce766fd91dac6bd258
MD5 39daff21adab62238ae07bdd9930ae24
SHA1 b44b4ce37675e604714fb96b5fef31b88fd4a9cc
SHA512 b118ae9a6588d74333b622afb26cbe78361b003c470cacf195b368a676dece1040b4ff9ad4672bd2f8f3c324d19a553e37b88a2f41a4b56336bc35ab797e090a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39daff21adab62238ae07bdd9930ae24.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WmWMVa\eiAHb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

memory/1620-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download

memory/1620-55-0x0000000000350000-0x00000000003A3000-memory.dmp

Download