emotet | cfed078f7cc8691bfff675c5d20c32f9b27094df345a4223587a7bbd9eec8a43

Analysis

Target
b05bc684e3262b067aa7b844b024fc22.dll
Size 705KB
Sample220714-har44adcc8
SHA256 cfed078f7cc8691bfff675c5d20c32f9b27094df345a4223587a7bbd9eec8a43
MD5 b05bc684e3262b067aa7b844b024fc22
SHA1 52947cf5cb6639f37841c1292083ba64b24afb3a
SHA512 fec85240a5807f9cdf50e7323e69b49577dae2b677a71967f029b8e5698a462391863c49c945905ad79fea7cce92e1e927a188d6665a8481c95d075d5f275812
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1932	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1328	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1328	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1328	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1328	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1328	1932	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b05bc684e3262b067aa7b844b024fc22.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FRXbklY\rMJf.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

memory/1932-54-0x000007FEFC111000-0x000007FEFC113000-memory.dmp

Download

memory/1932-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download