emotet | e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d

Analysis

Target
emotet_exe_e4_e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d_2022-03-03__000044.dll
Size 599KB
Sample220303-aaxetagfc7
SHA256 e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d
MD5 26ab57ac7d22b0fafad26dfc36cc3553
SHA1 1fcdb9cfd97d317e847816e8df82833b848aa361
SHA512 9150ec5de10a0dd38ab325c5f66a6524080eaf3514cb151eac5419a847a8c8842b92ab148646eab33c5c6d88f20ece38c432cca36867c8bf87592867f644cdd1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	regsvr32.exe
872	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 872	3944	regsvr32.exe	56
PID 3944 wrote to memory of 872	3944	regsvr32.exe	56
PID 3944 wrote to memory of 872	3944	regsvr32.exe	56

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d_2022-03-03__000044.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e272fc030adfda51b43a31d6fb35c13e6f0a8289bf8a0e883166f43d771feb7d_2022-03-03__000044.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872

memory/872-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download