emotet | 1e9629634267bde90ce1dc520a69b0eb3d69eb626f84eec075c35a861682ecde

Analysis

Target
emotet_exe_e4_1e9629634267bde90ce1dc520a69b0eb3d69eb626f84eec075c35a861682ecde_2022-02-25__000015.dll
Size 652KB
Sample220225-aazvyadhe8
SHA256 1e9629634267bde90ce1dc520a69b0eb3d69eb626f84eec075c35a861682ecde
MD5 946f2b990ab8b8464d3933764a8d4191
SHA1 7cac524b07d6bf400ab1796b064ef28ffa0dc9b5
SHA512 965f374ab30151b879ba847f592055da8bde2573cf546d7ec4fab7cdd8fdaeea3e389b48c2abc6ccea87ea1ac7d7956ceb9e0cbdbf1de1828bbc131261efa190
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	regsvr32.exe
2772	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2772	2264	regsvr32.exe	82
PID 2264 wrote to memory of 2772	2264	regsvr32.exe	82
PID 2264 wrote to memory of 2772	2264	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1e9629634267bde90ce1dc520a69b0eb3d69eb626f84eec075c35a861682ecde_2022-02-25__000015.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1e9629634267bde90ce1dc520a69b0eb3d69eb626f84eec075c35a861682ecde_2022-02-25__000015.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772

memory/2772-130-0x0000000010000000-0x0000000010026000-memory.dmp

Download