emotet | 73d60f408806535848409b9e2f45cc3ba9328d398ad11ce9ce93c2f6a91abbf3

Analysis

Target
73d60f408806535848409b9e2f45cc3ba9328d398ad11ce9ce93c2f6a91abbf3.dll
Size 564KB
Sample220705-qectzabdc7
SHA256 73d60f408806535848409b9e2f45cc3ba9328d398ad11ce9ce93c2f6a91abbf3
MD5 b338ad933429b015df7c2405b0f36d93
SHA1 8ebeb5903e4b05c7fc15079191c5b4bb8c638af2
SHA512 ca4474735def23c8abef2a96e62065189ee8e53fde1745e47e92dbcaca83c7ef0b62f406f4851c85421ee4645cc3d202e43eca88d5183b1617bbf2bad0f5516b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1712	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1432	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1432	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1432	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1432	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1432	1712	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73d60f408806535848409b9e2f45cc3ba9328d398ad11ce9ce93c2f6a91abbf3.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SdXDQaCGLwYFKleb\ssAxi.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

memory/1712-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Download

memory/1712-55-0x0000000000510000-0x000000000053D000-memory.dmp

Download