emotet | 2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9

Analysis

Target
emotet_exe_e4_2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9_2022-02-22__215639.dll
Size 500KB
Sample220222-1txg2aece9
SHA256 2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9
MD5 7aa34606c04ca4518b7e267e3a31e101
SHA1 5c7c2b5cad535c2b78066ff79608f8a99ae62518
SHA512 92e51633c1eeab2da0ba5c88f1a3e46eefe79795325bca013e1a4f0cf7f9b29268b2688716ecbc44a2c480f33bad052163ea271af6e71fd95537fc7f233f7a06
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1656	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27
PID 1188 wrote to memory of 1656	1188	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9_2022-02-22__215639.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2b6991b2a9e7cb496b7569860fc4fb3cd3e244885a6664b9a84e4e3a44fc70d9_2022-02-22__215639.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656

memory/1188-55-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Download

memory/1656-56-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Download

memory/1656-57-0x00000000001B0000-0x00000000001D6000-memory.dmp

Download