emotet | 3de2b5a3ce838bf1d6e1a2b5086e4d185ac03d19bb83a60e781b23b45e06cc86

Analysis

Target
39ba040a9d9dcda97d497fe159fe6233.dll
Size 733KB
Sample220702-c9affaecb7
SHA256 3de2b5a3ce838bf1d6e1a2b5086e4d185ac03d19bb83a60e781b23b45e06cc86
MD5 39ba040a9d9dcda97d497fe159fe6233
SHA1 5907eae360b721a860e703e7a3d535e13492511c
SHA512 396b71dbccf7361fb590b5a14f8a2cf1ab8433df376855e2cfb839e92388412b785a22906f9977797af086efcd91b888ac5f9438fb35b1e7e998f4e0155d95c3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1668	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1128	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1128	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1128	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1128	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1128	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39ba040a9d9dcda97d497fe159fe6233.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SliDVhNsBDMIMI\NqbEJGUZggfY.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

memory/1668-54-0x000007FEFC111000-0x000007FEFC113000-memory.dmp

Download

memory/1668-55-0x0000000001F40000-0x0000000001FC6000-memory.dmp

Download