emotet | a97a86507df6c5e4e21350ae907aef2bfff3758ce03cf0986ffa9d4d1d731ab5

Analysis

Target
a7baee2234bdc173441b364cdc6c4d3f.dll
Size 510KB
Sample220714-jfza2affd4
SHA256 a97a86507df6c5e4e21350ae907aef2bfff3758ce03cf0986ffa9d4d1d731ab5
MD5 a7baee2234bdc173441b364cdc6c4d3f
SHA1 625905269df0e5e027bd6baca5fa6250b0e68e68
SHA512 9afe021b9f7a5e9f29a6508abc422cdb76e2566ef05758347b012f90f19348b9b2d41fbfe96a8d706ca54e18d0c383a9e6cac0773c14db4891bae52b2f1e663e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
936	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2884	936	regsvr32.exe	78
PID 936 wrote to memory of 2884	936	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a7baee2234bdc173441b364cdc6c4d3f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HrSXaFrdRLrawv\gAnO.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884

memory/936-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download