emotet | b0e81f194484dbab78b73dce11a1b0ab8c15dbd42ae7a2276b7df04874f41570

Analysis

Target
emotet_exe_e5_b0e81f194484dbab78b73dce11a1b0ab8c15dbd42ae7a2276b7df04874f41570_2022-03-04__000304.dll
Size 611KB
Sample220304-adfapsdaa7
SHA256 b0e81f194484dbab78b73dce11a1b0ab8c15dbd42ae7a2276b7df04874f41570
MD5 5719904b19b4a5d5f87166759b07fcee
SHA1 0427590598d74dc1820c2d12fb202ae6ee616f01
SHA512 b7f4cb13bcc3a166f91a6d670a3927526ba96bcea4248dae9b98be18b0d1f9f3aefba8257cdf8651284fb46e119ffeb0b2d6b1750f4d0bec1a31c7f7d22b715d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1784	regsvr32.exe
1784	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1784	3884	regsvr32.exe	55
PID 3884 wrote to memory of 1784	3884	regsvr32.exe	55
PID 3884 wrote to memory of 1784	3884	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b0e81f194484dbab78b73dce11a1b0ab8c15dbd42ae7a2276b7df04874f41570_2022-03-04__000304.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b0e81f194484dbab78b73dce11a1b0ab8c15dbd42ae7a2276b7df04874f41570_2022-03-04__000304.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

memory/1784-130-0x0000000010000000-0x0000000010027000-memory.dmp

Download