emotet | e9a2f199e5216f76af82c072b741f5abd9a1972ca3c47fce766fd91dac6bd258

Analysis

Target
39daff21adab62238ae07bdd9930ae24.dll
Size 423KB
Sample220630-c61hfshae2
SHA256 e9a2f199e5216f76af82c072b741f5abd9a1972ca3c47fce766fd91dac6bd258
MD5 39daff21adab62238ae07bdd9930ae24
SHA1 b44b4ce37675e604714fb96b5fef31b88fd4a9cc
SHA512 b118ae9a6588d74333b622afb26cbe78361b003c470cacf195b368a676dece1040b4ff9ad4672bd2f8f3c324d19a553e37b88a2f41a4b56336bc35ab797e090a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2084	1964	regsvr32.exe	80
PID 1964 wrote to memory of 2084	1964	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39daff21adab62238ae07bdd9930ae24.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZFkceVCLDSV\BXtKxQDtR.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

memory/1964-130-0x0000000002540000-0x0000000002593000-memory.dmp

Download