emotet | 3a845cf36f9a04eb6fa48e329316966bc0fa456d1dc68ce315e41bdda3b50ec4

Analysis

Target
400acf98c6709c5789f5ae59287c8e8e.dll
Size 314KB
Sample220714-e2k83sdder
SHA256 3a845cf36f9a04eb6fa48e329316966bc0fa456d1dc68ce315e41bdda3b50ec4
MD5 400acf98c6709c5789f5ae59287c8e8e
SHA1 36c0e6e6ca0d344d2f5e81d3a12082fcd22a6ac3
SHA512 ff207e8cc14da8121b4f973839736942378617ae02843e6c38427d96e19cbd705cf2152550daf97ea9e4a2eaeba3ae9df140c5ad674934336b6db35523312ce3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3656	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 2864	3656	regsvr32.exe	83
PID 3656 wrote to memory of 2864	3656	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\400acf98c6709c5789f5ae59287c8e8e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NdXQuwRV\jyahRxdUtVpB.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864

memory/3656-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download