emotet | 9a4d4f2261d048afeed0ddc4f5bf3d2e86a8c31cdc96f9ab0d8fe1b3f8aa8ae0

Analysis

Target
83aa6e087b609ceb705f377112f0ba8d.dll
Size 786KB
Sample220708-al64dsabbm
SHA256 9a4d4f2261d048afeed0ddc4f5bf3d2e86a8c31cdc96f9ab0d8fe1b3f8aa8ae0
MD5 83aa6e087b609ceb705f377112f0ba8d
SHA1 28767c44b561594ac3f9f2599461d54d6a2a40d4
SHA512 fe55cbe2e1d5eabde71c6177bf7ecb66514f98eaa432c0a8492184438d14f440ce93410083893736fdafb8c726178f9ea4ab0bdd325eb0879b352137c0b59aae
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2676	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 4408	2676	regsvr32.exe	83
PID 2676 wrote to memory of 4408	2676	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\83aa6e087b609ceb705f377112f0ba8d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WPlah\UKXdPnOZkIAZms.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408

memory/2676-130-0x0000000001FD0000-0x0000000002000000-memory.dmp

Download