emotet | 3ee0501329a3f7eb4b4fe33ab2e5836ed88c552909f55497d9d4f960a9eefb9d

Analysis

Target
eb81fa8eee8fb3ee0ca716b98d3dd66a.dll
Size 847KB
Sample220714-e64afsgfe6
SHA256 3ee0501329a3f7eb4b4fe33ab2e5836ed88c552909f55497d9d4f960a9eefb9d
MD5 eb81fa8eee8fb3ee0ca716b98d3dd66a
SHA1 833ca944dab23ee6afbd37b03c9716111713a812
SHA512 67488c83b7a10904dd0d029ac890f25b4543692041f4aa083645cef2596ae45703e3547dc50a39f5f3e69e44b0174db6b9ea02f20b5c390f7b6e38f4ceb5801f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4608	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2136	4608	regsvr32.exe	81
PID 4608 wrote to memory of 2136	4608	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eb81fa8eee8fb3ee0ca716b98d3dd66a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UtuHAvgmWBulGKa\bBikcEViyn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136

memory/4608-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download