emotet | b70ef3fdd00b3f4bc703a35e82afa7571e12fed336c3253436b897b5ec1bdd93

Analysis

Target
5fdedebdd161dd5546af65fc71c30474.dll
Size 470KB
Sample220706-ltb4rsdcf8
SHA256 b70ef3fdd00b3f4bc703a35e82afa7571e12fed336c3253436b897b5ec1bdd93
MD5 5fdedebdd161dd5546af65fc71c30474
SHA1 b1727eaf0821c3294da89d2683012d0fffec273a
SHA512 fe0862179e898b4a3f6f0d0289d4e3ba26a3e642ab141aa2fbc79b7d27907e8056903d2f57197aae394a2c068aa9baf641d61eeb4bd77a53e3dfa994c0f3b45c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
364	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1664	364	regsvr32.exe	28
PID 364 wrote to memory of 1664	364	regsvr32.exe	28
PID 364 wrote to memory of 1664	364	regsvr32.exe	28
PID 364 wrote to memory of 1664	364	regsvr32.exe	28
PID 364 wrote to memory of 1664	364	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fdedebdd161dd5546af65fc71c30474.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LGWFsfdElUJKeio\GKAlMoBejbUWSpi.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

memory/364-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

Download

memory/364-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download