emotet | d2fb2b874a744056149ad11fc6d4eb5388304d9a69a2d5c2dccfafa8e1252833

Analysis

Target
emotet_exe_e4_d2fb2b874a744056149ad11fc6d4eb5388304d9a69a2d5c2dccfafa8e1252833_2022-03-02__135539.dll
Size 600KB
Sample220302-q8p2dsfah4
SHA256 d2fb2b874a744056149ad11fc6d4eb5388304d9a69a2d5c2dccfafa8e1252833
MD5 81531142c2072b852bc02b633a4fd4bf
SHA1 7eb729a5fe7745ca01e93f527a2594a574f0c7b3
SHA512 cc44bd8566d76227d26e2242cac410c3a8a6c78d0c2c9fae6e183293fe94e920bf4e2b6098476ab1a90872fc06cea11e5f37a1aa4ccac6c731c75621daa645e2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2164	regsvr32.exe
2164	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2164	1540	regsvr32.exe	79
PID 1540 wrote to memory of 2164	1540	regsvr32.exe	79
PID 1540 wrote to memory of 2164	1540	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d2fb2b874a744056149ad11fc6d4eb5388304d9a69a2d5c2dccfafa8e1252833_2022-03-02__135539.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d2fb2b874a744056149ad11fc6d4eb5388304d9a69a2d5c2dccfafa8e1252833_2022-03-02__135539.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

memory/2164-130-0x00000000028F0000-0x0000000002918000-memory.dmp

Download