emotet | faffe389bf6128f86c0a9bc428b52f6cd2a8ff57d13e04492d06dc96413d6f56

Analysis

Target
emotet_exe_e4_faffe389bf6128f86c0a9bc428b52f6cd2a8ff57d13e04492d06dc96413d6f56_2022-02-24__000212.dll
Size 664KB
Sample220224-ab3cfsbfd6
SHA256 faffe389bf6128f86c0a9bc428b52f6cd2a8ff57d13e04492d06dc96413d6f56
MD5 db2161426c2408877d1ed2ded8d42b53
SHA1 696c4c77be398585ef257bd52794a6b07eb67983
SHA512 896836024a7b86b05155bf92173b4b96e232b37f411bf013549616dadf48424ac65ae82a764a44a9ca229c761dfdb737e0f6c525541548bc7d23b219ce709676
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4488	regsvr32.exe
4488	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4488	3448	regsvr32.exe	82
PID 3448 wrote to memory of 4488	3448	regsvr32.exe	82
PID 3448 wrote to memory of 4488	3448	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_faffe389bf6128f86c0a9bc428b52f6cd2a8ff57d13e04492d06dc96413d6f56_2022-02-24__000212.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_faffe389bf6128f86c0a9bc428b52f6cd2a8ff57d13e04492d06dc96413d6f56_2022-02-24__000212.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488

memory/4488-130-0x00000000020A0000-0x00000000020C6000-memory.dmp

Download