emotet | 82b96fd9172b4f53fc8f369bdf57247ec0aeb7f00ce685e80ccd79747196233c

Analysis

Target
d9b941f09f3986ee494952327b07d988.dll
Size 518KB
Sample220714-jpac9sgbc2
SHA256 82b96fd9172b4f53fc8f369bdf57247ec0aeb7f00ce685e80ccd79747196233c
MD5 d9b941f09f3986ee494952327b07d988
SHA1 23560fa54e605197d49f40fe3573a6101d80abe1
SHA512 854987ebb4bf2b58323aa7ebd639e6664bfa96eaf87ee0a86f4b0101e5c7b3a50c2fd5ee418813505cec4c98dc4ef39fc56437c95b37191d694a98b4b82dec30
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1524	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1180	1524	regsvr32.exe	28
PID 1524 wrote to memory of 1180	1524	regsvr32.exe	28
PID 1524 wrote to memory of 1180	1524	regsvr32.exe	28
PID 1524 wrote to memory of 1180	1524	regsvr32.exe	28
PID 1524 wrote to memory of 1180	1524	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9b941f09f3986ee494952327b07d988.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YgatbGr\MnfAZwWINcupxf.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

memory/1524-54-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Download

memory/1524-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download