emotet | 78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7

Analysis

Target
emotet_exe_e5_78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7_2022-02-24__000234.dll
Size 660KB
Sample220224-ab3cfsbfe2
SHA256 78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7
MD5 391433c4c8651c53f2d7d334b2688968
SHA1 81e64d8c89810d69468d1031eab0169fe2c5c2ce
SHA512 a2427f02f6de8e726a6b31aa6c4a31bbf0eaef6631fa1b0c476f8754fb11d9f059ddf24042ce2254bf9bc6fab550a67d7c58583c10f2227f130aa409b828ccbe
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	regsvr32.exe
4720	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4720	4072	regsvr32.exe	82
PID 4072 wrote to memory of 4720	4072	regsvr32.exe	82
PID 4072 wrote to memory of 4720	4072	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7_2022-02-24__000234.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7_2022-02-24__000234.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720

memory/4720-130-0x0000000001370000-0x0000000001395000-memory.dmp

Download