emotet | d1dc16fe6dfcefd84f1ca9622a5b1460ea8243d17cf5994bf44e238d424796d6

Analysis

Target
3dcade1fa01590f766f8e7093220a05e.dll
Size 535KB
Sample220704-kc3dysfffk
SHA256 d1dc16fe6dfcefd84f1ca9622a5b1460ea8243d17cf5994bf44e238d424796d6
MD5 3dcade1fa01590f766f8e7093220a05e
SHA1 ae2d2104d1eee96aaeadc613264ffaab08ef09c5
SHA512 c81868eff6239ec0135cc27f09ac6948ab2c68aa1327bea2f71a362e411aaecb1fa128077b39c5a416353d6e23ebef46a78cdd1f44d9b1cd45059ca58d3e7b6d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3656	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 5096	3656	regsvr32.exe	81
PID 3656 wrote to memory of 5096	3656	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3dcade1fa01590f766f8e7093220a05e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JrMYz\gFmnonsoAkqrKXx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

memory/3656-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download