emotet | e8d7b5860c60bb955e5d4ccd70fe5d7486895d3789e3a126378e052a0571c78a

Analysis

Target
1f1cbbae5842bef5ed86dc2139d93834.dll
Size 723KB
Sample220703-c755bsccel
SHA256 e8d7b5860c60bb955e5d4ccd70fe5d7486895d3789e3a126378e052a0571c78a
MD5 1f1cbbae5842bef5ed86dc2139d93834
SHA1 a598f637a55e3900a88858f5dc09a8d6c1f1cd8b
SHA512 f28a5d3476621e112cbfdce32abc10f225f76e9de0a5569b2c6c6e1675be1653784e855ac8ac48f0219c560b543c90300b63e8f064877098cb5410c6e8e2ad67
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1068	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1100	1068	regsvr32.exe	28
PID 1068 wrote to memory of 1100	1068	regsvr32.exe	28
PID 1068 wrote to memory of 1100	1068	regsvr32.exe	28
PID 1068 wrote to memory of 1100	1068	regsvr32.exe	28
PID 1068 wrote to memory of 1100	1068	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f1cbbae5842bef5ed86dc2139d93834.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MviBmKTUlwZeIFTN\wRVWnt.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

memory/1068-54-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmp

Download

memory/1068-55-0x0000000001F20000-0x0000000001FA3000-memory.dmp

Download