emotet | 905ca2b7a8fde6dc27015b4db88284655cc660a58d75d92427ca0876da582268

Analysis

Target
emotet_exe_e4_905ca2b7a8fde6dc27015b4db88284655cc660a58d75d92427ca0876da582268_2022-03-04__000144.dll
Size 615KB
Sample220304-abgezschf6
SHA256 905ca2b7a8fde6dc27015b4db88284655cc660a58d75d92427ca0876da582268
MD5 46b9106f62f9a8e23f387ea06cc1361d
SHA1 7224a0d6732df3991ca3a724bc31ece10ef8ec4b
SHA512 47cba52cd3f6ae9949585ce69080706bf3e29cae626ef8ff61df5c02d29b952b504021dd0c722fe80db651e336b5bde7d19da74be53ca61e3544556f722f68d1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1080	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_905ca2b7a8fde6dc27015b4db88284655cc660a58d75d92427ca0876da582268_2022-03-04__000144.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_905ca2b7a8fde6dc27015b4db88284655cc660a58d75d92427ca0876da582268_2022-03-04__000144.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080

memory/1080-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1080-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1664-54-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Download