emotet | bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698

Analysis

Target
emotet_exe_e4_bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698_2022-02-23__223231.dll
Size 664KB
Sample220223-2ghnsabdh5
SHA256 bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698
MD5 ebbda590af9021227583daad353e45fb
SHA1 76ab55527d220386487397b516aeaa5b915c318c
SHA512 995c6b16842e16f570008b3c5f7b95293bdc582f1b492b150d1e6a20a69a195581114abc710beca9783a0779333b061a9f89eafc2a81943829b64f9968f75713
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1688	regsvr32.exe
1688	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1688	2176	regsvr32.exe	81
PID 2176 wrote to memory of 1688	2176	regsvr32.exe	81
PID 2176 wrote to memory of 1688	2176	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698_2022-02-23__223231.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_bd57d24afb51fc0791dedfc035755d526788ad9c5f03147ee04ef6ec55f3c698_2022-02-23__223231.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688

memory/1688-133-0x0000000002E10000-0x0000000002E36000-memory.dmp

Download