emotet | b9b59516e14f55fb3edc8c858bca6c8defd97f75b1240dba384cde7e772a974d

Analysis

Target
b6d02f81b08ddc542cdfa4134cf38c64.dll
Size 765KB
Sample220705-c9a2zadccn
SHA256 b9b59516e14f55fb3edc8c858bca6c8defd97f75b1240dba384cde7e772a974d
MD5 b6d02f81b08ddc542cdfa4134cf38c64
SHA1 aa1749d7fc2939d5e2acad295d8d60d3c8facc64
SHA512 c190219228bf8de95258ce4f6c48f0934bdcb348f084fc07d5de9659066400baffd2efd8eed6e30f0096d0615f90b9ef8bc1aa33cb0542955aeece009c54b275
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3744	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 5012	3744	regsvr32.exe	83
PID 3744 wrote to memory of 5012	3744	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6d02f81b08ddc542cdfa4134cf38c64.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NgQNFwQdIY\sOmeG.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

memory/3744-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download