emotet | 880e74d5b07f9e1828db32af0417e9b073e7795caa073901c86cce93a2b94eb0

Analysis

Target
4fc39257fe9f2f3ffad1d1953318b67e.dll
Size 314KB
Sample220714-jv2ppsdfcp
SHA256 880e74d5b07f9e1828db32af0417e9b073e7795caa073901c86cce93a2b94eb0
MD5 4fc39257fe9f2f3ffad1d1953318b67e
SHA1 c966c734357ab2fd119898858d53a03d7af8fc7f
SHA512 8454ddb1c2864c341daf4f173c23f39342309f2d3512b6abefab5f4bfed201faa58c4e5a046b032747f71c86630e861e7cdf3059b63a388e44a99c4bc3fbe2fa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2008	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1932	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1932	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1932	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1932	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1932	2008	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4fc39257fe9f2f3ffad1d1953318b67e.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PIauoxiPkseiquP\hYLjySykSllabHj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

memory/2008-54-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Download

memory/2008-55-0x00000000002E0000-0x000000000030A000-memory.dmp

Download