emotet | cbe51cfd59addc7d8a9bcc5e05a02b3656d56a2ecd374a03299ae642c640924b

Analysis

Target
33ab7eccf29890cdfe95e966bf00d06e.dll
Size 1004KB
Sample220302-vj6easfff4
SHA256 cbe51cfd59addc7d8a9bcc5e05a02b3656d56a2ecd374a03299ae642c640924b
MD5 33ab7eccf29890cdfe95e966bf00d06e
SHA1 723c3823182f0afc1166e7f9ab83ba3a0d4656bf
SHA512 79ec40d5c3b361d61f31e0514eb97160ee7482e85a135b4990588b0c0871831720aa655ad33715133f90c27495e46c4f65b419313c88c40d850a5afd93b63523
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1528	1692	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33ab7eccf29890cdfe95e966bf00d06e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33ab7eccf29890cdfe95e966bf00d06e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

memory/1528-55-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/1528-56-0x0000000000840000-0x0000000000867000-memory.dmp

Download

memory/1692-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Download