emotet | 11e5de96e3f0a7dc59c530e3c84bde2fdacd665d2bf4a72b1a5f9bd12c83ffcb

Analysis

Target
emotet_exe_e4_11e5de96e3f0a7dc59c530e3c84bde2fdacd665d2bf4a72b1a5f9bd12c83ffcb_2022-03-04__000143.dll
Size 615KB
Sample220304-abgezschf8
SHA256 11e5de96e3f0a7dc59c530e3c84bde2fdacd665d2bf4a72b1a5f9bd12c83ffcb
MD5 aa1db87d60e86457c4f86f496d95f80b
SHA1 82a7ccf444cac56eccb15e178b4ce543750f28de
SHA512 3b6322000e7da4e6e6925d19e23a7e44b63ff6e8ededc94a1203cf400e9c2590fdf1a9fda9ca913328fd0ee147ba5f11b9c20485e98565dac8d872bb09065bd0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1432	regsvr32.exe
1432	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1432	864	regsvr32.exe	80
PID 864 wrote to memory of 1432	864	regsvr32.exe	80
PID 864 wrote to memory of 1432	864	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11e5de96e3f0a7dc59c530e3c84bde2fdacd665d2bf4a72b1a5f9bd12c83ffcb_2022-03-04__000143.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11e5de96e3f0a7dc59c530e3c84bde2fdacd665d2bf4a72b1a5f9bd12c83ffcb_2022-03-04__000143.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

memory/1432-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download