emotet | 4a63d04c50c5319ecb2c047c2bd021befe3cb9d3f0cc8f47ba0f5ebe2835d61a

Analysis

Target
2d71db23c20fab2e2741741f7fd44a95.dll
Size 723KB
Sample220702-c35yrscefm
SHA256 4a63d04c50c5319ecb2c047c2bd021befe3cb9d3f0cc8f47ba0f5ebe2835d61a
MD5 2d71db23c20fab2e2741741f7fd44a95
SHA1 86373f60026a5dfe58e61e8d7e1c9af8552c5b6c
SHA512 0e42acce5b23c48cb7994f5fd8a1a8ad6e58866144644b9548ab028fb45e262cfa211b6ae0bb3aa8436b0315b3d1eea7ba3f2351ae503091039599b05ad28092
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
756	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 940	756	regsvr32.exe	28
PID 756 wrote to memory of 940	756	regsvr32.exe	28
PID 756 wrote to memory of 940	756	regsvr32.exe	28
PID 756 wrote to memory of 940	756	regsvr32.exe	28
PID 756 wrote to memory of 940	756	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d71db23c20fab2e2741741f7fd44a95.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YyAtsJS\AWdNkyPXjcnJ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940

memory/756-54-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Download

memory/756-55-0x0000000001EC0000-0x0000000001F43000-memory.dmp

Download