emotet | 6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33

Analysis

Target
emotet_exe_e5_6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33_2022-03-03__000305.dll
Size 604KB
Sample220303-acvc8sgff8
SHA256 6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33
MD5 c02f5b680bf0e0972ce5556b5cad76f6
SHA1 75632ee3b0e3e0d3dd48a0a75ea3324659f9e56b
SHA512 c1625fd5c03690fbd55629a7fb54e7db11fb42a46dbf9402ba830ccfe772f9af165f1a95b6c489dfcdf9d039fffe48e07dd8647e8394d565b0bf81a9c13a1941
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
960	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33_2022-03-03__000305.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6c8ffcb358b0dd6d7c1e05a04872bc725cad7d1a79b6ba8e5fd13b9cef6ded33_2022-03-03__000305.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960

memory/960-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/960-56-0x0000000000730000-0x0000000000757000-memory.dmp

Download

memory/1088-54-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Download