emotet | ff079cdb8d3ef13bf53224fbd727efe900c2f6ab6a7fc853a914cde4ce6c5c21

Analysis

Target
3f233f71ff76cf79dd556e1084133f14.dll
Size 548KB
Sample220701-bthlfaecbq
SHA256 ff079cdb8d3ef13bf53224fbd727efe900c2f6ab6a7fc853a914cde4ce6c5c21
MD5 3f233f71ff76cf79dd556e1084133f14
SHA1 9831c91c950427d9f3aa50b3017cad16ae0e9f60
SHA512 0cfc9827bc5df375550ecd754a77734b737963edf92be6ac262b5c3adf81c74100455cc0efadf02d547c1daf3f2af788089dde7ae9b927efaea330f5aa8ff124
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1640	1528	regsvr32.exe	26
PID 1528 wrote to memory of 1640	1528	regsvr32.exe	26
PID 1528 wrote to memory of 1640	1528	regsvr32.exe	26
PID 1528 wrote to memory of 1640	1528	regsvr32.exe	26
PID 1528 wrote to memory of 1640	1528	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f233f71ff76cf79dd556e1084133f14.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IfZDWmm\yfZqnRTEmjuvXGQ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

memory/1528-54-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Download

memory/1528-55-0x0000000000460000-0x00000000004BA000-memory.dmp

Download