emotet | 9ca9ac1c7bc09ee9e497e47cf54295625b00a3b74e2a1e3bea0b4034f401de10

Analysis

Target
a4e637a6b6ac26fb2f292a3968e4643f.dll
Size 348KB
Sample220709-az7l3sdda2
SHA256 9ca9ac1c7bc09ee9e497e47cf54295625b00a3b74e2a1e3bea0b4034f401de10
MD5 a4e637a6b6ac26fb2f292a3968e4643f
SHA1 840e6955d628347784880cd25a277828b0626ab8
SHA512 fbd56f05b352a376f7b542b3e203e685013b5ddae0c36a6d27e5d28fa5488f92bdb007bfe0ceb432febb3530cede5e8b35257e4dd31596aaeb5fe5e286cf1bf3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3268	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3924	3268	regsvr32.exe	81
PID 3268 wrote to memory of 3924	3268	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a4e637a6b6ac26fb2f292a3968e4643f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MmgiVh\WneO.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

memory/3268-130-0x0000000002340000-0x0000000002370000-memory.dmp

Download