emotet | f7e6f2ce62d3ef4f446c6787cb96daf142acc5cbc2c39e3909cd29847183569e

Analysis

Target
3586bb080052ac854c6d966276066c4c.dll
Size 423KB
Sample220630-jly78abba2
SHA256 f7e6f2ce62d3ef4f446c6787cb96daf142acc5cbc2c39e3909cd29847183569e
MD5 3586bb080052ac854c6d966276066c4c
SHA1 0a60119ca126d5518c6afb99d415a06bedf949c3
SHA512 9b42970def07b75aa08b1e2820252e0a517f60d06c0a2c22eaf47a022988957d5087f26a7192de371cdc5c07881417b4355067c80809cbd223548f458fcfc6ae
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1808	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4336	1808	regsvr32.exe	84
PID 1808 wrote to memory of 4336	1808	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3586bb080052ac854c6d966276066c4c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\REKEcDdra\TYFZyzJkaVqqe.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

memory/1808-130-0x00000000010C0000-0x0000000001113000-memory.dmp

Download