emotet | 00f2f121daafd0cc2f273ba2eabe84b73fc77c81798f0f5dee7b677cd11d1b89

Analysis

Target
85151e894b34391f07dd7a33b3f8f447.dll
Size 837KB
Sample220707-becrmsddf4
SHA256 00f2f121daafd0cc2f273ba2eabe84b73fc77c81798f0f5dee7b677cd11d1b89
MD5 85151e894b34391f07dd7a33b3f8f447
SHA1 662a77b6cdd3bc4af65cc3d61a2306d3ed2d8b2c
SHA512 3a1a5922ad43671530ba0332dbc05cf859966fe69211e01562d7b0fc7cdfa061e4627ab1c3be3f9e802037117f09f406ee2ffa1a6401f3d646fc41f98ddfde31
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 952	1280	regsvr32.exe	27
PID 1280 wrote to memory of 952	1280	regsvr32.exe	27
PID 1280 wrote to memory of 952	1280	regsvr32.exe	27
PID 1280 wrote to memory of 952	1280	regsvr32.exe	27
PID 1280 wrote to memory of 952	1280	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\85151e894b34391f07dd7a33b3f8f447.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NBESdCrqrsAukghx\wQuvXniaLnsbLiK.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952

memory/1280-54-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

Download

memory/1280-55-0x0000000180000000-0x000000018002D000-memory.dmp

Download