emotet | 8b02a062a75b704d8397e0cf21d466c9f953c5a18fa532d3e22ec085de2209bc

Analysis

Target
f74b53330e2980f5e20b11e7f0f1510c.dll
Size 470KB
Sample220706-l43dpsbeaq
SHA256 8b02a062a75b704d8397e0cf21d466c9f953c5a18fa532d3e22ec085de2209bc
MD5 f74b53330e2980f5e20b11e7f0f1510c
SHA1 233a92b41d519e18f7136259292de35c4ce9a73d
SHA512 af89e0aba1bab8bfedd770999be4ef7d813e9dd8edc00027f9ab667d54ed43d5ad4f70a5c38ea837de35ab4968f8feb90f142b250493663415c5a0c5c0207fac
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1260	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 928	1260	regsvr32.exe	26
PID 1260 wrote to memory of 928	1260	regsvr32.exe	26
PID 1260 wrote to memory of 928	1260	regsvr32.exe	26
PID 1260 wrote to memory of 928	1260	regsvr32.exe	26
PID 1260 wrote to memory of 928	1260	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f74b53330e2980f5e20b11e7f0f1510c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CfKneiSYPyZcU\TYHPwyUzRMmfL.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928

memory/1260-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download

memory/1260-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download