emotet | b8e3e47fa4e74801dcdd99d29b1b416cb4ac210d2f69cd84692580e9037f8016

Analysis

Target
49e4ce30ba55a2635aaaf29a91dbc786.dll
Size 278KB
Sample220714-ggd1dabec3
SHA256 b8e3e47fa4e74801dcdd99d29b1b416cb4ac210d2f69cd84692580e9037f8016
MD5 49e4ce30ba55a2635aaaf29a91dbc786
SHA1 1c9a7c9c10d11919b237da41bcf2f43149e17967
SHA512 e2f90ab45bbd7ec77ef8da60f29ce021fe50fa3c91e64ab869eb14cf500734bdf01060b1ccdc2a69b5d39c3b5ef4031fc7fc336f00ad2fb20d209be521c781bd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2380	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1356	2380	regsvr32.exe	81
PID 2380 wrote to memory of 1356	2380	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\49e4ce30ba55a2635aaaf29a91dbc786.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SqdJOPMXngfAEY\UIIAYYlPZZETA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

memory/2380-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download