emotet | 3160872ff0ce117f4bfa947da4dafbdf403af34817dc360d2fdaed7088d95075

Analysis

Target
746c274d251a581223c84a13461a80e8.dll
Size 755KB
Sample220705-bb3hwsedh6
SHA256 3160872ff0ce117f4bfa947da4dafbdf403af34817dc360d2fdaed7088d95075
MD5 746c274d251a581223c84a13461a80e8
SHA1 41a45bc8850a71c87248f25cd3ea957c1d7d110e
SHA512 35774e31f8e567f40713d0373c272b239febc218f5bea49c354339021a6099fc658ee78a36704f0620d68e9463474d1132f6eba8d10dde06026c13b344bcfdff
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
644	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28
PID 644 wrote to memory of 1144	644	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\746c274d251a581223c84a13461a80e8.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IyswmhUZ\iPDzvjlmxlHI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144

memory/644-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/644-55-0x0000000180000000-0x000000018002D000-memory.dmp

Download