emotet | 3d097c5010f8ea090e4e7d629e271c9c244da927a43588217e209e24132f23ca

Analysis

Target
88c61b34d57d9fcd6fea652b619838ed.dll
Size 981KB
Sample220704-mz4lmsgfgr
SHA256 3d097c5010f8ea090e4e7d629e271c9c244da927a43588217e209e24132f23ca
MD5 88c61b34d57d9fcd6fea652b619838ed
SHA1 e61ceef5433db1141679a996a996acd151279dd1
SHA512 6d8ebffe878b420f63e1f206ee4c1238efa13556b65053e802b9625915a1b8d0872b64da04aa53d92c81c8b28fe1573004aef7bafb982d5bc8e682daa862ee70
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
872	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1324	872	regsvr32.exe	27
PID 872 wrote to memory of 1324	872	regsvr32.exe	27
PID 872 wrote to memory of 1324	872	regsvr32.exe	27
PID 872 wrote to memory of 1324	872	regsvr32.exe	27
PID 872 wrote to memory of 1324	872	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88c61b34d57d9fcd6fea652b619838ed.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IMBmOk\ZRKeAs.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324

memory/872-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Download

memory/872-55-0x0000000000200000-0x000000000022D000-memory.dmp

Download