emotet | 2e5ff3d038894e872823d68b53b0a1a64eea8066cd3adc49d61097994f0375a6

Analysis

Target
c7808afa0448e8ca4e0f365bb7953b43.dll
Size 1.0MB
Sample220224-2wp2eadgg8
SHA256 2e5ff3d038894e872823d68b53b0a1a64eea8066cd3adc49d61097994f0375a6
MD5 c7808afa0448e8ca4e0f365bb7953b43
SHA1 103ce85099aa7bbf383a117b6cd39728a2e87146
SHA512 a01ffe5460b6d32c7deaea65ff236785435ae1e4a7dce9eb470f919b12753d386bccccb2b3ae52962a35e4b7ace9c48993f6584fcce0c3a133bc893e47d0955a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1160	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27
PID 1676 wrote to memory of 1160	1676	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c7808afa0448e8ca4e0f365bb7953b43.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c7808afa0448e8ca4e0f365bb7953b43.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160

memory/1160-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download

memory/1160-57-0x0000000000280000-0x00000000002A5000-memory.dmp

Download

memory/1676-55-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmp

Download