emotet | ea776b090d22d1ed5384b004fcbc7db6c13d95b569b5a4f4c91d23533c93fb98

Analysis

Target
3abf6c905ad03573d7242e2aa2a01a45.dll
Size 646KB
Sample220714-hytylabffr
SHA256 ea776b090d22d1ed5384b004fcbc7db6c13d95b569b5a4f4c91d23533c93fb98
MD5 3abf6c905ad03573d7242e2aa2a01a45
SHA1 80c6d64a3310affb8e752bad146eac9de5505d9e
SHA512 34648e1426431eb6c90518657855a62560004c3e2e65e1fd41b70bda67e7505406fab9fcf3b959ae5faf0c26c515360286e160622c6d0874d684a4cbf501cfa6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1380	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1140	1380	regsvr32.exe	26
PID 1380 wrote to memory of 1140	1380	regsvr32.exe	26
PID 1380 wrote to memory of 1140	1380	regsvr32.exe	26
PID 1380 wrote to memory of 1140	1380	regsvr32.exe	26
PID 1380 wrote to memory of 1140	1380	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3abf6c905ad03573d7242e2aa2a01a45.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DFCQlriaNq\UEHePqdkaNBo.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1140

memory/1380-54-0x000007FEFB721000-0x000007FEFB723000-memory.dmp

Download

memory/1380-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download