emotet | de62ee3bc3c93fdb7e83cddea6a822dc04a8d609485d42326c783b05135d0c77

Analysis

Target
83a1bbcfe13762ba3d3a271ab8fc56ac.dll
Size 524KB
Sample220706-bdsrgafaek
SHA256 de62ee3bc3c93fdb7e83cddea6a822dc04a8d609485d42326c783b05135d0c77
MD5 83a1bbcfe13762ba3d3a271ab8fc56ac
SHA1 b71d665a3e8e84c4b05551a9302586550f8f8b19
SHA512 4f89b018ba1cbc13062f470548ef3a495359696aabc7d835c156e57abb5cb6b659de96502e3cb06c3e2c534f6bba3461b5cbddf8051c234a9cb44d39a62691e1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2368	1964	regsvr32.exe	79
PID 1964 wrote to memory of 2368	1964	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\83a1bbcfe13762ba3d3a271ab8fc56ac.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HpGUiLhQivZPyeb\ZhvkLqEQi.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

memory/1964-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download