emotet | 618a1b95e50d6a95e1909d0bea70e7ca87a3c7a6f5b800c884dc3eb5e9607d15

Analysis

Target
0e445e2a2199554c5d27042aa473fee1.dll
Size 529KB
Sample220714-e5hmcsgef6
SHA256 618a1b95e50d6a95e1909d0bea70e7ca87a3c7a6f5b800c884dc3eb5e9607d15
MD5 0e445e2a2199554c5d27042aa473fee1
SHA1 e9d7988dfc5a0cdbbbddb45bf4a6734ebf7ee948
SHA512 2850f65ca32569cb5a7487f14f556ea62857af3cda79c025b7a614702fbe6c8b1738740012e43ed803c3f712f525a7211f5c58e06adfbefb30269b097c62490f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1956	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2020	1956	regsvr32.exe	27
PID 1956 wrote to memory of 2020	1956	regsvr32.exe	27
PID 1956 wrote to memory of 2020	1956	regsvr32.exe	27
PID 1956 wrote to memory of 2020	1956	regsvr32.exe	27
PID 1956 wrote to memory of 2020	1956	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0e445e2a2199554c5d27042aa473fee1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JxxKtocJXAN\HFUcCVtBNR.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

memory/1956-54-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Download

memory/1956-55-0x0000000000220000-0x000000000027A000-memory.dmp

Download