emotet | 037bf87b8dccf7e61bce89b73fe17d87c1ec797944d657d30c4d9f1b41209585

Analysis

Target
d9ddf2729d444282ebf27c8940bff071.dll
Size 522KB
Sample220714-jpac9sgbb7
SHA256 037bf87b8dccf7e61bce89b73fe17d87c1ec797944d657d30c4d9f1b41209585
MD5 d9ddf2729d444282ebf27c8940bff071
SHA1 b2cd7819ac2dbbba32d50940600d2a04372ca41b
SHA512 aaff612ebdc012b91f92b9ae092331012ce014f74abed20dd582c4ffad605ef2d14d994db1ef2ecd2c3feab8afe49e8438efd45c44d3eccffb030c50087bb466
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1564	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1148	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1148	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1148	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1148	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1148	1564	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9ddf2729d444282ebf27c8940bff071.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IntwdXE\PRUMnlWv.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

memory/1564-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1564-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download