emotet | d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9

Analysis

Target
emotet_exe_e4_d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9_2022-02-24__000211.dll
Size 664KB
Sample220224-ab22pabfc7
SHA256 d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9
MD5 57b2a20b61e40ef0f5d5361db6bffbd3
SHA1 40324c112852eb4791c5ae9ebe15843925769ea3
SHA512 5f5e63f91773de1dde6aeefd23d226414a327a603b0ee4cdd2dfbd45772b65fc70ec5e588eb06084f790cafcc0a97b5a8b9a558319c688ff1d929552dfce1b5a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	regsvr32.exe
2576	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2576	1288	regsvr32.exe	81
PID 1288 wrote to memory of 2576	1288	regsvr32.exe	81
PID 1288 wrote to memory of 2576	1288	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9_2022-02-24__000211.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9_2022-02-24__000211.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

memory/2576-130-0x0000000002220000-0x0000000002246000-memory.dmp

Download