emotet | 4a6fbeb94bccc3b14929c45c7d034fcf4e4575bd73ad0ed22441e8d7b9809503

Analysis

Target
5478563fa3ab38bc38531fe74b57b6c2.dll
Size 847KB
Sample220707-bvntvabddm
SHA256 4a6fbeb94bccc3b14929c45c7d034fcf4e4575bd73ad0ed22441e8d7b9809503
MD5 5478563fa3ab38bc38531fe74b57b6c2
SHA1 0fda17c133fcaffda713c00acd53ea61344b79d7
SHA512 95ffd43c5e220f9d4b6a74bec30edf87ac696295e15c4e84c55e48f6f22dc20586eb5cf9d141872442dec98bf5266f8d6a17290865075a424acd408a17f864e0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2280	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3156	2280	regsvr32.exe	80
PID 2280 wrote to memory of 3156	2280	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5478563fa3ab38bc38531fe74b57b6c2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VQNyYI\yjdxowjAwAOB.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

memory/2280-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download