emotet | c965b93a5b88829cb6d24717dad4db60d1f8a112e8bd57f7e48036bbadcfbcb9

Analysis

Target
84ae421890a3bd485ae6978d062a0a5e.dll
Size 513KB
Sample220706-cl9wdsheb2
SHA256 c965b93a5b88829cb6d24717dad4db60d1f8a112e8bd57f7e48036bbadcfbcb9
MD5 84ae421890a3bd485ae6978d062a0a5e
SHA1 27d25112ae41be9ab6116e273dc8b7c9ee21cf55
SHA512 779cc1ecc025bd11392b223584d720ede3c5f32f0a2e71c49d426b5c21a2a32bd25db7e28747a71cf52ad2094661aef58790c6a5135da902028112797a649b2f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2076	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1848	2076	regsvr32.exe	81
PID 2076 wrote to memory of 1848	2076	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\84ae421890a3bd485ae6978d062a0a5e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PgDxN\ohYaZWWGLukWu.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848

memory/2076-130-0x0000000180000000-0x000000018002D000-memory.dmp

Download