emotet | 608178b7e6c609d3969519c16bb67d1c1760f05fe33a88e2e5b818d46e0bd9fd

Analysis

Target
emotet_exe_e5_608178b7e6c609d3969519c16bb67d1c1760f05fe33a88e2e5b818d46e0bd9fd_2022-03-04__000303.dll
Size 611KB
Sample220304-adfapsdaa5
SHA256 608178b7e6c609d3969519c16bb67d1c1760f05fe33a88e2e5b818d46e0bd9fd
MD5 2350738b9ccec061a717776958ac84e7
SHA1 270bba30353356ca5d5387ee4060d4aedfab7d40
SHA512 a96446603e03ea4c09638823838a70622906cb1cb504d1b583c3847b03d493dc5d4ad6db5dab05ecdaf5017bc93fecf3047a35c43f983afce522467ec5645273
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_608178b7e6c609d3969519c16bb67d1c1760f05fe33a88e2e5b818d46e0bd9fd_2022-03-04__000303.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_608178b7e6c609d3969519c16bb67d1c1760f05fe33a88e2e5b818d46e0bd9fd_2022-03-04__000303.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

memory/952-55-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Download

memory/1752-56-0x0000000076B81000-0x0000000076B83000-memory.dmp

Download

memory/1752-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download