emotet | 128bf4c4bf82b73f602e57a9eec52ea630c05435feb6cdd0d411d184b1b2326e

Analysis

Target
a60a6ad9655bb646f6a488b53fd8ebae.dll
Size 278KB
Sample220709-cnd7habcap
SHA256 128bf4c4bf82b73f602e57a9eec52ea630c05435feb6cdd0d411d184b1b2326e
MD5 a60a6ad9655bb646f6a488b53fd8ebae
SHA1 c994b5eabc2c5c5e1eef4d1b1678480c292f5446
SHA512 9dd87bb1b7a75c380467134614a8de4524910dc6e0c72f77ed3c0ba69143e51143012a2738c36a8f9f6c89d341843676ccf3e5bf15c850b1ad3e8ea95e1ce07c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1752	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1224	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1224	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1224	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1224	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1224	1752	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a60a6ad9655bb646f6a488b53fd8ebae.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WNvfy\cITqhNskONj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224

memory/1752-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download

memory/1752-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download