emotet | 1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2

Analysis

Target
emotet_exe_e4_1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2_2022-02-22__215641.dll
Size 500KB
Sample220222-1txg2aecf4
SHA256 1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2
MD5 ca05f4ec28bd0c61842d7bb4923f768d
SHA1 582ad0ffcec67ca964978d6f931daf9c34750cb9
SHA512 6bfbe10b7e57422023b7913268b51d03d66c00e6e3ce76dada10dc550896c2545661c3ba4b7e5eec7debce730e1d9da15411144f96aaabc1bc1051d790f28d65
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
268	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2_2022-02-22__215641.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1ce558c397c6369e587e3b3f16eb6b2daa92d760cd7a1f642f8a87c55fc46ac2_2022-02-22__215641.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:268

memory/268-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/268-56-0x0000000000210000-0x0000000000236000-memory.dmp

Download

memory/1172-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Download