emotet | 6c7dbbb62302110577a36b3c1e4e41652e4c05182d3f8b8f2b4a94cf732df163

Analysis

Target
adfa510256101aa77d4f24ff4a6e610a.dll
Size 611KB
Sample220304-af4fbadac8
SHA256 6c7dbbb62302110577a36b3c1e4e41652e4c05182d3f8b8f2b4a94cf732df163
MD5 adfa510256101aa77d4f24ff4a6e610a
SHA1 2bc6f56750d5d8ca910481782aa0ba91c39fcb50
SHA512 bd1f7f2925709c7fece8fe3b08c591b907eb0df7f3bde94a9404b483ebf9958ec893568b9319d33b1edcb9de59a3e5cfa147b22c41b19adcb5044d236d7580c1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1604	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1604	1616	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\adfa510256101aa77d4f24ff4a6e610a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\adfa510256101aa77d4f24ff4a6e610a.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

memory/1604-55-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/1604-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1616-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Download