emotet | cd37519cbc6ab97ca0cc35abaf054596bf221684dac5620d5b6c8b14ed802406

Analysis

Target
554b2cf75ae3ae35dc58331f6b9e9295.dll
Size 755KB
Sample220705-bbg7yscefl
SHA256 cd37519cbc6ab97ca0cc35abaf054596bf221684dac5620d5b6c8b14ed802406
MD5 554b2cf75ae3ae35dc58331f6b9e9295
SHA1 0a004c4973a924da82a84e8bbe219557dd8afbc0
SHA512 5af9b5fcb9a8d6d36c9151b486712e07f18b13ad095324413fb60698d38fc0f1af49bfc8f85014ec0b98aa431d4df6409d47541215cae35e0ed71414c599c632
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1308	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1432	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1432	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1432	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1432	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1432	1308	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\554b2cf75ae3ae35dc58331f6b9e9295.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZssPofaMRaMlrta\UGZbcelGsnUFb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

memory/1308-54-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp

Download

memory/1308-55-0x0000000180000000-0x000000018002D000-memory.dmp

Download