emotet | da8fd116e1e179b86d228f792b218fb2651684d84367a6659b945a58958bcc4d

Analysis

Target
615e833519a58405c8db126efc5f7ae0.dll
Size 733KB
Sample220702-azma5scabl
SHA256 da8fd116e1e179b86d228f792b218fb2651684d84367a6659b945a58958bcc4d
MD5 615e833519a58405c8db126efc5f7ae0
SHA1 ae9e747c126bd4a88f3db79e355d37b97cca8983
SHA512 1b22a63398653a0d03663486359439f2f42537e77d66c8ac920c2a088c1f3e464420d051d2a4cf77b24932c8fe98b732fb7bc9cc63b3263802b505a09fd77975
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1620	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26
PID 1620 wrote to memory of 1932	1620	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\615e833519a58405c8db126efc5f7ae0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DWEAiYEtMJlnbM\PlAReuK.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

memory/1620-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download

memory/1620-55-0x0000000001F10000-0x0000000001F96000-memory.dmp

Download