emotet | 8f0a5418cfda5eefcff134ca88990a76f259ae0ab4aba14b07be96b0f2e7880e

Analysis

Target
21208aeabc503000eeec927cee9d1a93.dll
Size 548KB
Sample220714-ftt2pafadn
SHA256 8f0a5418cfda5eefcff134ca88990a76f259ae0ab4aba14b07be96b0f2e7880e
MD5 21208aeabc503000eeec927cee9d1a93
SHA1 4e2ad041c64f7f0ff42766585e00aff66b9d6105
SHA512 de15bcdbe54516cfeee3c6779b65d20ddc71d5492129eb7f2159e0feabe23a8506bdf14a68fa4639d26ec88c7af76d31767add7d551ec81b3438d080ac740b77
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4460	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4400	4460	regsvr32.exe	80
PID 4460 wrote to memory of 4400	4460	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21208aeabc503000eeec927cee9d1a93.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SDuqjjuZv\ARwKplYkgAyAKI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400

memory/4460-130-0x00000000026F0000-0x000000000274A000-memory.dmp

Download