emotet | db5720b70338bb33748afd5f554dd7929eecd577ac685967e112956f9f96392c

Analysis

Target
8i2V.dll
Size 660KB
Sample220224-lv3ccacff2
SHA256 db5720b70338bb33748afd5f554dd7929eecd577ac685967e112956f9f96392c
MD5 d7a4678fb13942990b8f094bbd7811b1
SHA1 7f7b2be9cc51bff2312a45b357da9d9c2cd3d965
SHA512 efa75e449d8327e41f77d795bfff70f0c9ff2185619932733516d6b2f3772392047da1edc21183b9ef88a6632140e9f0e87af060f7c5c877ab1043891c867614
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1736	1548	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8i2V.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8i2V.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

memory/1548-55-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Download

memory/1736-56-0x00000000762C1000-0x00000000762C3000-memory.dmp

Download

memory/1736-57-0x0000000000870000-0x0000000000895000-memory.dmp

Download