emotet | 27a886793c653bb69c886a3db1fb6753e9ecd184bd4459af9c315fa7ef29eeca

Analysis

Target
TS5.dll
Size 323KB
Sample220707-pdqtrsgber
SHA256 27a886793c653bb69c886a3db1fb6753e9ecd184bd4459af9c315fa7ef29eeca
MD5 b08edb650316f8c46257b58767f5fd65
SHA1 b33b5864f47ad8f089e12893453fea00f4db27a5
SHA512 773e2b57fdc10571cefc243b9e697a7f74bbda4ea917c5e6f00bb7ad7cf1e1699fa406da1143d006e3afd2b90534f0b3f56af2f3ef022da773c6de94998bd317
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1884	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1260	1884	regsvr32.exe	27
PID 1884 wrote to memory of 1260	1884	regsvr32.exe	27
PID 1884 wrote to memory of 1260	1884	regsvr32.exe	27
PID 1884 wrote to memory of 1260	1884	regsvr32.exe	27
PID 1884 wrote to memory of 1260	1884	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TS5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZckThtpUXDMzXole\etZadcvHa.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260

memory/1884-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Download

memory/1884-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download