emotet | cd551c3b88bcded3b87055cef06817e4a321e2e70dc71d972172b22d805be3dc

Analysis

Target
59e01a93b6bedbde253bc8b07a6ad61d.dll
Size 513KB
Sample220706-bphqmshae4
SHA256 cd551c3b88bcded3b87055cef06817e4a321e2e70dc71d972172b22d805be3dc
MD5 59e01a93b6bedbde253bc8b07a6ad61d
SHA1 ddad352de2ba0751b99ae639852679389eb272ed
SHA512 c469ee830ac4d356b50707b15ad33dd4190d78fb78192e102eb5b4b5a452facb7476ec0c385d2d22ba25155ef65c82291dfb4bde4b95564cd4c31a575cd8e13f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3132	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4180	3132	regsvr32.exe	80
PID 3132 wrote to memory of 4180	3132	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59e01a93b6bedbde253bc8b07a6ad61d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UKFuiq\KVtTHzWNMtrZWno.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180

memory/3132-130-0x0000000180000000-0x000000018002D000-memory.dmp

Download