emotet | ebc8f30ccecd559659cce3d69784bbcc8d40a97492580b753f57e5358ef25dcb

Analysis

Target
9f498e27421e18bec395e13402a55233.dll
Size 558KB
Sample220701-c1v1saabe5
SHA256 ebc8f30ccecd559659cce3d69784bbcc8d40a97492580b753f57e5358ef25dcb
MD5 9f498e27421e18bec395e13402a55233
SHA1 93bf69a40512e51794500f7d4722c81b66cfa396
SHA512 055e710d3946171f88a099cd72fc36dc3f7e54de22ef5d2ce80514bc3c9d3cdaf50337e4e13e22b8673fdd03a8abc7063414e8dba21ac033e94ab9047d73180a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2700	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3444	2700	regsvr32.exe	80
PID 2700 wrote to memory of 3444	2700	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9f498e27421e18bec395e13402a55233.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HKfkaMqIndpb\auJLBDI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444

memory/2700-130-0x0000000002700000-0x000000000275D000-memory.dmp

Download