emotet | 1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520

Analysis

Target
emotet_exe_e4_1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520_2022-02-24__134854.dll
Size 652KB
Sample220224-q4q3wsedap
SHA256 1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520
MD5 49444fd39145e629f5a0c0e42c13f120
SHA1 e26d33a8a01d742f8419e4e426d65a4cfdddfc6c
SHA512 75a983a76bd46e4b024e013b1ce81c54f9f7854d85fc490091243612ee470720cc1c10ae1f5edd34181516314a8fa221645760c183968ecddf98c7cee1543bb2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	regsvr32.exe
4592	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4592	2784	regsvr32.exe	82
PID 2784 wrote to memory of 4592	2784	regsvr32.exe	82
PID 2784 wrote to memory of 4592	2784	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520_2022-02-24__134854.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520_2022-02-24__134854.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

memory/4592-130-0x0000000010000000-0x0000000010026000-memory.dmp

Download