emotet | 691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347

Analysis

Target
emotet_exe_e4_691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347_2022-02-24__000211.dll
Size 664KB
Sample220224-ab22pabfc6
SHA256 691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347
MD5 f7f82fdca70a07b005dd20de4f5081f0
SHA1 a4172f899fd624846d11bab1f54afbf3fe291f55
SHA512 eabca46ccc5182ca7791f35b05e3b4e9a7a96e60d54142194cd6cd4c2c400a0141fddaee9d0cacc3e46163a03bca91879b92315b7cba0bb432cd919066050881
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1956	regsvr32.exe
1956	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1956	644	regsvr32.exe	58
PID 644 wrote to memory of 1956	644	regsvr32.exe	58
PID 644 wrote to memory of 1956	644	regsvr32.exe	58

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347_2022-02-24__000211.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347_2022-02-24__000211.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

memory/1956-130-0x0000000000A50000-0x0000000000A76000-memory.dmp

Download