emotet | 959027fcabea3fe49af89f34232ef5afdeda405b03e8b3c18feae350df791c41

Analysis

Target
x0YB4GYNRIq.dll
Size 323KB
Sample220707-pc7qwsabb5
SHA256 959027fcabea3fe49af89f34232ef5afdeda405b03e8b3c18feae350df791c41
MD5 d64005ef7bbd79d7361105b1e3bf8c51
SHA1 9036125f9cbed2b29795e3506971c8ea738a3d32
SHA512 726f4d6a7a686d38bd75c93b0c97c0818ef204c8461e647a7a0302923442f73dfb115e72ffba9e96703c487e6324d1490c20919e7a6d3cd88ccc813689e28c2f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
952	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27
PID 952 wrote to memory of 972	952	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x0YB4GYNRIq.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZueoPQktmNHbZ\RlPYm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/952-54-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Download

memory/952-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download