emotet | 67844c82948e7e08c5d5f75c2d32871483651f528b21358d8e2ebc7aebb1912e

Analysis

Target
c7ce81f037f173c2a56d1e9204dde5c2.dll
Size 847KB
Sample220707-axb3dsdbc4
SHA256 67844c82948e7e08c5d5f75c2d32871483651f528b21358d8e2ebc7aebb1912e
MD5 c7ce81f037f173c2a56d1e9204dde5c2
SHA1 07bffc2bb11f88667d37c9b7bf511f2c7edac1f3
SHA512 be4e4a953e902baca93b642aa43d169010269462d01146486168e9fa37419ec194804b45ac2a63362f241fbe5909c1fed0ea876a97e3ad5cc317556ed8da8afd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1744	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1628	1744	regsvr32.exe	28
PID 1744 wrote to memory of 1628	1744	regsvr32.exe	28
PID 1744 wrote to memory of 1628	1744	regsvr32.exe	28
PID 1744 wrote to memory of 1628	1744	regsvr32.exe	28
PID 1744 wrote to memory of 1628	1744	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c7ce81f037f173c2a56d1e9204dde5c2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NOVMFbWDpv\qHGkYVfFTwUz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628

memory/1744-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Download

memory/1744-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download