emotet | e9bb54fb3dce64f7b291f6aee242a3e11237633e201c129404c66cfe9d4d5106

Analysis

Target
acbebf3f0e03f6370151f99de7d1a665.dll
Size 548KB
Sample220701-c1vp1sabe2
SHA256 e9bb54fb3dce64f7b291f6aee242a3e11237633e201c129404c66cfe9d4d5106
MD5 acbebf3f0e03f6370151f99de7d1a665
SHA1 c18970d2c96ce215c417c9632987fceb9fa56583
SHA512 dede30d8f7cea682beeb0730fea35c3af2736f7178516b8126e56bbe0934c4007a60918559e86eacf9a04cb652c0c2a23a6eaa70683cda84c92cb9e52a45fa53
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1884	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 664	1884	regsvr32.exe	27
PID 1884 wrote to memory of 664	1884	regsvr32.exe	27
PID 1884 wrote to memory of 664	1884	regsvr32.exe	27
PID 1884 wrote to memory of 664	1884	regsvr32.exe	27
PID 1884 wrote to memory of 664	1884	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\acbebf3f0e03f6370151f99de7d1a665.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VxMJbACuk\wfOtSKCcO.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:664

memory/1884-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Download

memory/1884-55-0x0000000001DB0000-0x0000000001E0A000-memory.dmp

Download