emotet | 093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0

Analysis

Target
emotet_exe_e5_093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0_2022-03-03__091159.dll
Size 1.0MB
Sample220303-k6srlsabe2
SHA256 093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0
MD5 55787b8b4c8b382c5c7935af8a12ea1d
SHA1 ea72291546d1b441ea162ad9685d5beab2abc43f
SHA512 60082641b1c4dbe3e7d37964a1de14f7aac538da721d50f730a36e46b90a74120f4955c54acfcb37bc6984e23b2d550011a98bb39c2850e3b822e72467efd984
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
368	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27
PID 1824 wrote to memory of 368	1824	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0_2022-03-03__091159.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_093fb457637a3346e80604d9943dbbbc80ce014170a509ccaa87655ea06c98f0_2022-03-03__091159.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368

memory/368-56-0x0000000075421000-0x0000000075423000-memory.dmp

Download

memory/368-57-0x0000000000230000-0x0000000000257000-memory.dmp

Download

memory/1824-55-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Download