emotet | c3f3e4afa9e335bfa0a8856cbf5dcac907555c3b4ef72e9393d4883160ad8da8

Analysis

Target
e8fb7e7c455c08ee1eaa388aae3ca4f7.dll
Size 535KB
Sample220703-3hpddsffa5
SHA256 c3f3e4afa9e335bfa0a8856cbf5dcac907555c3b4ef72e9393d4883160ad8da8
MD5 e8fb7e7c455c08ee1eaa388aae3ca4f7
SHA1 d531eb9e2b9a44ff664992932161e37f5a862ef6
SHA512 21d97a736a566a54fea14e77683ebfb3e19c7174214f70d23928d8e6eae9c86b99f394a6e24d01c57b043f5103c7ca3a64dd18c8ac9141e0dd467628b434ca39
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2008	1964	regsvr32.exe	26
PID 1964 wrote to memory of 2008	1964	regsvr32.exe	26
PID 1964 wrote to memory of 2008	1964	regsvr32.exe	26
PID 1964 wrote to memory of 2008	1964	regsvr32.exe	26
PID 1964 wrote to memory of 2008	1964	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e8fb7e7c455c08ee1eaa388aae3ca4f7.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LrXMcGkMunDUY\ZWKdIDvESVcAUbS.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

memory/1964-54-0x000007FEFBC91000-0x000007FEFBC93000-memory.dmp

Download

memory/1964-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download