emotet | 118fc4d6a79148e2dd9efa87004880cbddd730178eeb9e783e104e965043a30e

Analysis

Target
xqCIVxFYBddh9Zn.dll
Size 1.1MB
Sample220223-p476qsabc2
SHA256 118fc4d6a79148e2dd9efa87004880cbddd730178eeb9e783e104e965043a30e
MD5 cf7cf3ede98680f39519010b247ff6e2
SHA1 5b02a5dafca5b927d2c0419b3a8ee80d833e70a6
SHA512 0e36d3fcdbd58c5476ad6aaf9617b05d84d906471fe5c68c9c5ee7720cb1a1f0c8dad21409bc9e418429427e2807fa391e72efac15c501c4811bded92c516766
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27
PID 1908 wrote to memory of 2032	1908	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xqCIVxFYBddh9Zn.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xqCIVxFYBddh9Zn.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

memory/1908-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Download

memory/2032-56-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/2032-57-0x0000000000300000-0x0000000000325000-memory.dmp

Download