emotet | c0d046faa01315ddbf5402a95cbdb5dfafe75baa33f73b3b0ce5753be61805af

Analysis

Target
13dc6d87308bb26253f2b6a6e37c4dfb.dll
Size 558KB
Sample220701-c1v1saabe7
SHA256 c0d046faa01315ddbf5402a95cbdb5dfafe75baa33f73b3b0ce5753be61805af
MD5 13dc6d87308bb26253f2b6a6e37c4dfb
SHA1 029239b0b7973ff39378bdd1b1b3b16a4c2827a4
SHA512 da1f0b5208036fffdff8957f1c705f6348dd4345a2b61de9d4509f600e4c201c7882f5ac92720c02dfcce0b9f5ce86d3b09c32e8ce0daf9c43705037af623748
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1756	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1712	1756	regsvr32.exe	28
PID 1756 wrote to memory of 1712	1756	regsvr32.exe	28
PID 1756 wrote to memory of 1712	1756	regsvr32.exe	28
PID 1756 wrote to memory of 1712	1756	regsvr32.exe	28
PID 1756 wrote to memory of 1712	1756	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13dc6d87308bb26253f2b6a6e37c4dfb.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AtyRsCFZmtww\UmtpZBpcskeA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

memory/1756-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download

memory/1756-55-0x0000000000210000-0x000000000026D000-memory.dmp

Download