emotet | 13fb12b07f25c01bf135cd18dbfca688719b97080a237ef15fa0a308e24397c8

Analysis

Target
f3f84946bfb6194da986604a4907e205.dll
Size 423KB
Sample220630-jfss9abae7
SHA256 13fb12b07f25c01bf135cd18dbfca688719b97080a237ef15fa0a308e24397c8
MD5 f3f84946bfb6194da986604a4907e205
SHA1 a08fbb60d79d51747b34af57050feac1b020a113
SHA512 a7b7888c88db98ff91cfa56000b6a148a6d11ad57048e98d9b1e5ed06989dc786403440fbb4c79efb07ffe76cdfdf9234d08c7801cebe2ce468e0340bc646efa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
776	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1044	776	regsvr32.exe	27
PID 776 wrote to memory of 1044	776	regsvr32.exe	27
PID 776 wrote to memory of 1044	776	regsvr32.exe	27
PID 776 wrote to memory of 1044	776	regsvr32.exe	27
PID 776 wrote to memory of 1044	776	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3f84946bfb6194da986604a4907e205.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MfAjwEeAEeNo\PldCkp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044

memory/776-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Download

memory/776-55-0x0000000000570000-0x00000000005C3000-memory.dmp

Download