emotet | 54b4d0984b5f5d2184edeef41e1cdfa8bbc6c958a1353e3de0d04331b5f71d77

Analysis

Target
23e76af3833bfb842ffdc5744ff90d5c.dll
Size 723KB
Sample220714-h94beafce8
SHA256 54b4d0984b5f5d2184edeef41e1cdfa8bbc6c958a1353e3de0d04331b5f71d77
MD5 23e76af3833bfb842ffdc5744ff90d5c
SHA1 26ff7058456ccd2088273ad322068bb5d28be2fa
SHA512 a2f94c899357a349d1cf284ac7a8ff801f7e0f2896179c3c1f50ad631ce8fd02b7a6c42352090de6c458bbce5364cb73684d4b35932652f8cc16e19dbee3c8cb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2044	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 940	2044	regsvr32.exe	27
PID 2044 wrote to memory of 940	2044	regsvr32.exe	27
PID 2044 wrote to memory of 940	2044	regsvr32.exe	27
PID 2044 wrote to memory of 940	2044	regsvr32.exe	27
PID 2044 wrote to memory of 940	2044	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\23e76af3833bfb842ffdc5744ff90d5c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TJmZlQ\mzyAcRpP.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940

memory/2044-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download

memory/2044-55-0x00000000005A0000-0x0000000000623000-memory.dmp

Download