emotet | 921a5256697c5a70135f1e7f71e622f643fb862b104c8dfdadd23e6330b7779d

Analysis

Target
f10b0bfe6b08cb955214949b01be774a.dll
Size 649KB
Sample220714-h147cabger
SHA256 921a5256697c5a70135f1e7f71e622f643fb862b104c8dfdadd23e6330b7779d
MD5 f10b0bfe6b08cb955214949b01be774a
SHA1 7015699222833ed31cd8afbdd9fd81ab6953a95d
SHA512 e3a2fab96490bfd9d7d949f3f047b949c167118c6b7232974db4041c05dba4d3d1f8bb01ab2bce86e727dfa0f0fd7b564624cb8eb5c93137ae026cda1d4692ee
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1992	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 276	1992	regsvr32.exe	27
PID 1992 wrote to memory of 276	1992	regsvr32.exe	27
PID 1992 wrote to memory of 276	1992	regsvr32.exe	27
PID 1992 wrote to memory of 276	1992	regsvr32.exe	27
PID 1992 wrote to memory of 276	1992	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f10b0bfe6b08cb955214949b01be774a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LPixZoTTo\VDioYxJvpmj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:276

memory/276-62-0x0000000000450000-0x00000000004F9000-memory.dmp

Download

memory/1992-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Download

memory/1992-55-0x0000000001CA0000-0x0000000001D49000-memory.dmp

Download

memory/1992-57-0x0000000180000000-0x000000018002A000-memory.dmp

Download