emotet | 3d3e5c0b8689fae3de202b110645f18c18aa3dc9c19b9ce601b37f955c152db4

Analysis

Target
8a020db655b97ee5e919eead0168bfbc.dll
Size 667KB
Sample220714-jpac9sgbb9
SHA256 3d3e5c0b8689fae3de202b110645f18c18aa3dc9c19b9ce601b37f955c152db4
MD5 8a020db655b97ee5e919eead0168bfbc
SHA1 34e12222611230155669e2c5aff033b686e6c14f
SHA512 c8aac6e81f20b5adbccfb72dc92578852582b510a54f5abcc559980555071ff401e8913e002498ed9b6d4a7f1591ba28a3d0afe88ffc5b3df416d5b43452280e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2616	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4044	2616	regsvr32.exe	79
PID 2616 wrote to memory of 4044	2616	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a020db655b97ee5e919eead0168bfbc.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MNVKf\XqUdQWp.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

memory/2616-130-0x0000000002B00000-0x0000000002B2A000-memory.dmp

Download