emotet | 03f23ef0b2fcb9feb7d075784d6a0ffbe2d93699981909a404a30c3e672bda57

Analysis

Target
6361c51248a8f53e0734f1a7c19a85c0.dll
Size 535KB
Sample220703-2hmzwsfeb2
SHA256 03f23ef0b2fcb9feb7d075784d6a0ffbe2d93699981909a404a30c3e672bda57
MD5 6361c51248a8f53e0734f1a7c19a85c0
SHA1 f0fca4d026ce592d4039074af36bc9424b144229
SHA512 a0808725c77d4b9bc5e5af661b3d3386de8d0c5fc748fa8fa00ba477eda70ccd1bd1b7508aefb724bfc20e2d38e50f1c21d1d7e50203e286c04b43f59f7cb7d3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 112	1964	regsvr32.exe	27
PID 1964 wrote to memory of 112	1964	regsvr32.exe	27
PID 1964 wrote to memory of 112	1964	regsvr32.exe	27
PID 1964 wrote to memory of 112	1964	regsvr32.exe	27
PID 1964 wrote to memory of 112	1964	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6361c51248a8f53e0734f1a7c19a85c0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DDnEafqY\TJkwqvHjI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112

memory/1964-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Download

memory/1964-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download