emotet | 78c7a70c6ded0d50ac20a84bb4cee54cc05baaaa7e64cdf5e2cf0b0bdd97f64a

Analysis

Target
a36f1f0f4a0994b8c8d58f26672149c9.dll
Size 461KB
Sample220706-l43dpsddh3
SHA256 78c7a70c6ded0d50ac20a84bb4cee54cc05baaaa7e64cdf5e2cf0b0bdd97f64a
MD5 a36f1f0f4a0994b8c8d58f26672149c9
SHA1 dc52fba97e9c4d448ce3a04777c18e213d9a45eb
SHA512 647620acb1b9c63ca89b2df5effb384edfec5809297a0880d789afe0d55d85a2699d584455a3f181f8cab0c5080164b754282853daa1b069f0e3db968cb679e1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
736	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 4052	736	regsvr32.exe	82
PID 736 wrote to memory of 4052	736	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a36f1f0f4a0994b8c8d58f26672149c9.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RIWLaa\SUsvG.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052

memory/736-130-0x0000000180000000-0x000000018002D000-memory.dmp

Download