emotet | 0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27

Analysis

Target
emotet_exe_e4_0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27_2022-03-03__000044.dll
Size 599KB
Sample220303-aaxetagfc8
SHA256 0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27
MD5 3d4d4d6e1d3c830275ffecc51d4c8e4e
SHA1 9e0eeaa89ca7ffb9fa9250c1c5470f4d7c4a1ae0
SHA512 19abbe3e3dfc63e812a98f0a34e1aa01419c9bdf3b8bd4f45dfcc85071bbc912892953ad61284135beccd1d0eee5aff3f1309e1a0dee4673c70313d7177d5d78
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	regsvr32.exe
1788	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1788	1596	regsvr32.exe	80
PID 1596 wrote to memory of 1788	1596	regsvr32.exe	80
PID 1596 wrote to memory of 1788	1596	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27_2022-03-03__000044.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0d3b5bcfdd2877705172d33db4cd430b4942f58d0653ea5022346df1d5472c27_2022-03-03__000044.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

memory/1788-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download