emotet | 402dec0383d1a678aab2e99b346fed596ec971fd75d33ab2312b34abf59e8eb9

Analysis

Target
167a003873dcc6ef4e44941a86bf3353.dll
Size 786KB
Sample220709-a1rl9adda7
SHA256 402dec0383d1a678aab2e99b346fed596ec971fd75d33ab2312b34abf59e8eb9
MD5 167a003873dcc6ef4e44941a86bf3353
SHA1 4a17c96b1f0928b49e3cf972b7d21f061d99519b
SHA512 fcfe37e272c67e9b94456c108aecf36af4400a8c3d1dcc3b558511082043ce88c2694d38f1649990767dc0b52352e5acb8bd28348c3366b5cc13c56736a9488d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27
PID 1964 wrote to memory of 1312	1964	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\167a003873dcc6ef4e44941a86bf3353.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XRnug\FTfQ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

memory/1964-54-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Download

memory/1964-55-0x0000000000160000-0x0000000000190000-memory.dmp

Download