emotet | 96375377d7a1b3e91aebb3d093eb7647a4a104ab7b64cf2ed3b0bac624ea0e73

Analysis

Target
64a14bb31ed32a3b501c457f5cc4e77f.dll
Size 524KB
Sample220706-bdsrgafaem
SHA256 96375377d7a1b3e91aebb3d093eb7647a4a104ab7b64cf2ed3b0bac624ea0e73
MD5 64a14bb31ed32a3b501c457f5cc4e77f
SHA1 ac2d2bb1be0e5528f889eb7bc70231699a593679
SHA512 b2f7afe5456083c5c835532ecc2271b160d46a2f279f16e425e70325c9bbbca0a6455e5a5db1111d0a67d1532e76ee0a1c9d57fc375e086c5a9f51caa3074a29
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2440	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2944	2440	regsvr32.exe	80
PID 2440 wrote to memory of 2944	2440	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64a14bb31ed32a3b501c457f5cc4e77f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZCNKQkmdxr\mdiGXUWhtCRKans.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944

memory/2440-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download