emotet | e0eb14d6b7cc1891e7bf366eae2e4aa8f761e39b9e9bd5002390c6da47a7d4e8

Analysis

Target
emotet_exe_e5_e0eb14d6b7cc1891e7bf366eae2e4aa8f761e39b9e9bd5002390c6da47a7d4e8_2022-02-25__000046.dll
Size 1.0MB
Sample220225-aaz6psdhg2
SHA256 e0eb14d6b7cc1891e7bf366eae2e4aa8f761e39b9e9bd5002390c6da47a7d4e8
MD5 613c024c4f47f9b29a6605aedb6f29aa
SHA1 90b69af881ece8437f8b35ea7d8d79b6dedd8c4f
SHA512 0a3212810254f9af341c9369cf052e75f055697a1bf0029715941a0a5eba0dae6f51c8299f1fec7c9974ae44aa3cd4cfd0ebad9847068a36c0d044c7d8022d4c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2644	regsvr32.exe
2644	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2644	3636	regsvr32.exe	59
PID 3636 wrote to memory of 2644	3636	regsvr32.exe	59
PID 3636 wrote to memory of 2644	3636	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e0eb14d6b7cc1891e7bf366eae2e4aa8f761e39b9e9bd5002390c6da47a7d4e8_2022-02-25__000046.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e0eb14d6b7cc1891e7bf366eae2e4aa8f761e39b9e9bd5002390c6da47a7d4e8_2022-02-25__000046.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644

memory/2644-130-0x0000000003010000-0x0000000003035000-memory.dmp

Download