emotet | 89aeb63af6d30637a0f5973ef9279cec458456dbec2eaedd55c5a40bb97f03b4

Analysis

Target
62ae5a8079a3584a7ba23fd81ac19533.dll
Size 604KB
Sample220302-3fefeagee6
SHA256 89aeb63af6d30637a0f5973ef9279cec458456dbec2eaedd55c5a40bb97f03b4
MD5 62ae5a8079a3584a7ba23fd81ac19533
SHA1 583ee650538fc3c33e91d57c81993c0801f121c2
SHA512 c6cbd9bf4ed2a02c8c1a0677406eae32ff7e8baab577fd33c105e900bb399e0f95adabe3352943f97cf6d94166663d2315f179ace2f5002ac66779b050078269
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
904	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27
PID 1532 wrote to memory of 904	1532	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62ae5a8079a3584a7ba23fd81ac19533.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62ae5a8079a3584a7ba23fd81ac19533.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904

memory/904-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

Download

memory/904-57-0x00000000002A0000-0x00000000002C7000-memory.dmp

Download

memory/1532-55-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Download