emotet | 3d0fcd8ead65fcda25492b0d8d2b5ad01ea6484fef06a71cb784ca447fb57251

Analysis

Target
4f6e8eacc4f5e2dffc4805570d664c7e.dll
Size 513KB
Sample220706-bec3eaghe2
SHA256 3d0fcd8ead65fcda25492b0d8d2b5ad01ea6484fef06a71cb784ca447fb57251
MD5 4f6e8eacc4f5e2dffc4805570d664c7e
SHA1 ca6129adc7e618f68ec00c585d4d91a15ed28bb7
SHA512 ed2ff119d2ea5ed7000ac01a102515819450ac4ef5f2ab4470a612a8f0e598ff312059671d17f276ce5dccfa49a6d6d215abbb15b3cdb6957c4b4d23e92d702f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1512	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 276	1512	regsvr32.exe	28
PID 1512 wrote to memory of 276	1512	regsvr32.exe	28
PID 1512 wrote to memory of 276	1512	regsvr32.exe	28
PID 1512 wrote to memory of 276	1512	regsvr32.exe	28
PID 1512 wrote to memory of 276	1512	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4f6e8eacc4f5e2dffc4805570d664c7e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FVlPzFvI\evqnILBQgCMlr.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:276

memory/1512-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download

memory/1512-55-0x0000000180000000-0x000000018002D000-memory.dmp

Download