emotet | e480ba98a71aa7e2c7fb019a2e616ffd8d46396842f6c825a0f40ce651ad2e87

Analysis

Target
08e29a71989dd262f0dc022cd1b3b22e.dll
Size 500KB
Sample220222-2askeaeed3
SHA256 e480ba98a71aa7e2c7fb019a2e616ffd8d46396842f6c825a0f40ce651ad2e87
MD5 08e29a71989dd262f0dc022cd1b3b22e
SHA1 277229b39d252e6064eae075733781cd43ce7614
SHA512 10898154fcd08d4fae6c2db9f238297f6841e161ce0610acab7dd7723ef93bdcdd4b900c84ebd5adb0e1ee30ed47bdd997ecceff41d891fa90b01e6bc38fc52c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1144	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1144	764	regsvr32.exe	27
PID 764 wrote to memory of 1144	764	regsvr32.exe	27
PID 764 wrote to memory of 1144	764	regsvr32.exe	27
PID 764 wrote to memory of 1144	764	regsvr32.exe	27
PID 764 wrote to memory of 1144	764	regsvr32.exe	27
PID 764 wrote to memory of 1144	764	regsvr32.exe	27
PID 764 wrote to memory of 1144	764	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08e29a71989dd262f0dc022cd1b3b22e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\08e29a71989dd262f0dc022cd1b3b22e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144

memory/764-55-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download

memory/1144-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1144-57-0x0000000000180000-0x00000000001A5000-memory.dmp

Download