emotet | bc29147a80dcfa9c653c49f56a972f8486fc14f1e1fd6e64fddee21757952d89

Analysis

Target
emotet_exe_e5_bc29147a80dcfa9c653c49f56a972f8486fc14f1e1fd6e64fddee21757952d89_2022-03-04__000304.dll
Size 611KB
Sample220304-adfapsdab3
SHA256 bc29147a80dcfa9c653c49f56a972f8486fc14f1e1fd6e64fddee21757952d89
MD5 593a8271ad0c063007006fb87a1411a3
SHA1 3318627592327b9b5af7996c5eb133bfa251d69b
SHA512 f9aae57666f3bbb5e7cd6f76335e09c3b1509941687272397bc447ab214cebfafa533bde66d2ac87e6ea9cc6d7b850202d827f7a44c4dbeebe90b92e28757c6c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1548	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1548	1684	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bc29147a80dcfa9c653c49f56a972f8486fc14f1e1fd6e64fddee21757952d89_2022-03-04__000304.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bc29147a80dcfa9c653c49f56a972f8486fc14f1e1fd6e64fddee21757952d89_2022-03-04__000304.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

memory/1548-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1548-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1684-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download