emotet | 377980a84fa0c5d31dc9d9eb3d6dcaba9bdfcf1f8f201f4888f2e523b629744d

Analysis

Target
02a9f2dea5ddd4e76f466f8023fe15ab.dll
Size 548KB
Sample220701-mc4ccsebf7
SHA256 377980a84fa0c5d31dc9d9eb3d6dcaba9bdfcf1f8f201f4888f2e523b629744d
MD5 02a9f2dea5ddd4e76f466f8023fe15ab
SHA1 848b09c0dacb4fd0364e2262b3f1e824fa92d406
SHA512 aa5a3bd7d04ae2998172c4ab215cb98dd6576916b20930011f894eb771bb51bdc99ee2018038463619329ce6ba189d5fa06b569ec81c7df7a49fe35b3747e868
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1664	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1240	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1240	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1240	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1240	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1240	1664	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02a9f2dea5ddd4e76f466f8023fe15ab.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZceORs\ULbNgjcgqu.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240

memory/1664-54-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Download

memory/1664-55-0x0000000001E20000-0x0000000001E7A000-memory.dmp

Download