emotet | 049bd9d40f677d4050017a80c3b7a6f048833177b464ca2d00aaf5c654e1a3a5

Analysis

Target
23ebd89cab8ec3211380bfb61c8e2512.dll
Size 278KB
Sample220709-a1rl9aager
SHA256 049bd9d40f677d4050017a80c3b7a6f048833177b464ca2d00aaf5c654e1a3a5
MD5 23ebd89cab8ec3211380bfb61c8e2512
SHA1 d3279a23a89d32fa327e25b97766c56291239884
SHA512 4f2a1647fa25210d1e4e0a958563b6d4e6eb4bb88469d12c2ed34f2c504909dc7c7a3bcafa4ec42a80efce56e291de6ecb28771c85d6daf2906baf108ff8d106
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1976	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1480	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1480	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1480	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1480	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1480	1976	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\23ebd89cab8ec3211380bfb61c8e2512.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TaneEttfrfnUIuU\FgWrQB.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480

memory/1976-54-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Download

memory/1976-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download