emotet | 4ebb3a8eaf7ea56ec740d1d6027dd57858ca7647a3256be64d905df152864666

Analysis

Target
311c3846bc308b9df997ef77657755ce.dll
Size 1.0MB
Sample220303-tkmsxabge6
SHA256 4ebb3a8eaf7ea56ec740d1d6027dd57858ca7647a3256be64d905df152864666
MD5 311c3846bc308b9df997ef77657755ce
SHA1 7f4382fc41974b498ef5c8a5e331368138faede7
SHA512 2fbcb4bf66abc3f066c1ea684acb7b532d63e9c4fe244ece8a7b964a7efd574c9b26ab64b21ce134656e8e6c7039083e3ca52495881c17f516f02629d7fd7aed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
516	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27
PID 1708 wrote to memory of 516	1708	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\311c3846bc308b9df997ef77657755ce.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\311c3846bc308b9df997ef77657755ce.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516

memory/516-55-0x0000000076891000-0x0000000076893000-memory.dmp

Download

memory/516-56-0x0000000001D80000-0x0000000001DA7000-memory.dmp

Download

memory/1708-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download