emotet | 5551643e2a44ed4a157b4ab3cbe80c135eebd4e3da99e4fb75f448338fff1651

Analysis

Target
209869485a300bac55bfc338187691f9.dll
Size 317KB
Sample220714-genf2agchq
SHA256 5551643e2a44ed4a157b4ab3cbe80c135eebd4e3da99e4fb75f448338fff1651
MD5 209869485a300bac55bfc338187691f9
SHA1 3f5c91fe328532cb3895f308f5527145ef7eb15e
SHA512 1a770bf6c91856426eb9e8575614fc8e9fdfa85802a56c281bbe207260d09b4cb32e17f71374baeda8e859235f2d02b3f7db58220314c1c67139e7aafcd293f5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4420	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 2328	4420	regsvr32.exe	81
PID 4420 wrote to memory of 2328	4420	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\209869485a300bac55bfc338187691f9.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DtLnGFTPRgDC\toCYVTGfaqTnHJ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

memory/4420-130-0x0000000180000000-0x000000018002A000-memory.dmp

Download