emotet | e30dafad1baa3cb79d7468448ff5835f47397ca98723ace415a3ec67059e82d1

Analysis

Target
efd9e87008cbff1cf13c0a9aa4b3d0f0.dll
Size 786KB
Sample220708-al64dscae4
SHA256 e30dafad1baa3cb79d7468448ff5835f47397ca98723ace415a3ec67059e82d1
MD5 efd9e87008cbff1cf13c0a9aa4b3d0f0
SHA1 42aaf55a6392305674c783fc1ac37256dddef306
SHA512 9635cddac470e8cfb744d2c097b49505c094ce18634c8593f5030b720c80ad3f98d18a1c85ef3ed43f0213dcb724137a9c9499c65ccc1f42203be427f61836fa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
796	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1476	796	regsvr32.exe	80
PID 796 wrote to memory of 1476	796	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\efd9e87008cbff1cf13c0a9aa4b3d0f0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JgvizzvXBgZ\zeKWivAVJn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

memory/796-130-0x0000000002B20000-0x0000000002B50000-memory.dmp

Download