emotet | ecd65df05484487f3f3ccedeaf3b1de3d4918f70313f92a24850f087fb22d3fb

Analysis

Target
4d98dfcdb260861c20c652258107590a.dll
Size 548KB
Sample220701-mcg45acfbk
SHA256 ecd65df05484487f3f3ccedeaf3b1de3d4918f70313f92a24850f087fb22d3fb
MD5 4d98dfcdb260861c20c652258107590a
SHA1 9ae739fb719a03874cc33065951d54e19e1f69bf
SHA512 5761285b20a1875b7e87314cb4e3a055c83dd6f573acfa3c02db89cc3c86cc565f576b05e8f6c099f39cc46def084293d0a202117665493c95b13b992055a462
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1356	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1192	1356	regsvr32.exe	28
PID 1356 wrote to memory of 1192	1356	regsvr32.exe	28
PID 1356 wrote to memory of 1192	1356	regsvr32.exe	28
PID 1356 wrote to memory of 1192	1356	regsvr32.exe	28
PID 1356 wrote to memory of 1192	1356	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d98dfcdb260861c20c652258107590a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MkQlKOkGfCSmb\NqHiVQPtd.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

memory/1356-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/1356-55-0x0000000001DE0000-0x0000000001E3A000-memory.dmp

Download