emotet | 2f874c27352c73ba97321f80bdb37a0b82d9c7e2d31fb2394f9701bc08ef0899

Analysis

Target
225f775bd3e165458312f774345f40db.dll
Size 755KB
Sample220705-b9tnmschdr
SHA256 2f874c27352c73ba97321f80bdb37a0b82d9c7e2d31fb2394f9701bc08ef0899
MD5 225f775bd3e165458312f774345f40db
SHA1 2ce8810625355d97d4f295171e1fbec05b3ab813
SHA512 d11913a03f8ad5158aec26dfb0dec9a9a038877bdd205cfb2d543690d9dc2e02d35f0131c507a3c83be507dda2274632e24df2693d8526217369543187cfc9be
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1836	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1328	1836	regsvr32.exe	28
PID 1836 wrote to memory of 1328	1836	regsvr32.exe	28
PID 1836 wrote to memory of 1328	1836	regsvr32.exe	28
PID 1836 wrote to memory of 1328	1836	regsvr32.exe	28
PID 1836 wrote to memory of 1328	1836	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\225f775bd3e165458312f774345f40db.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VJAwvLQhjQSGQbm\xjllOr.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

memory/1836-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download

memory/1836-55-0x0000000180000000-0x000000018002D000-memory.dmp

Download