emotet | d8ba8a2d17e14faa5d82da08cd03956754a491d3384bef93310ac92fad50f260

Analysis

Target
b73024fd4894ddc745268ad532a8b780.dll
Size 611KB
Sample220304-af4fbadac9
SHA256 d8ba8a2d17e14faa5d82da08cd03956754a491d3384bef93310ac92fad50f260
MD5 b73024fd4894ddc745268ad532a8b780
SHA1 6b538c86a75a4a954b7fa52d8829a402c90485a2
SHA512 644d502f0e5a9d8c502346444b9460cb6ecb573783f5c8feea50ba8eb7af26a01eeadf488090ae60d1ceb940c05367254858a9ba02327b9b01786e5d7dc3edce
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
972	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 972	756	regsvr32.exe	27
PID 756 wrote to memory of 972	756	regsvr32.exe	27
PID 756 wrote to memory of 972	756	regsvr32.exe	27
PID 756 wrote to memory of 972	756	regsvr32.exe	27
PID 756 wrote to memory of 972	756	regsvr32.exe	27
PID 756 wrote to memory of 972	756	regsvr32.exe	27
PID 756 wrote to memory of 972	756	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b73024fd4894ddc745268ad532a8b780.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b73024fd4894ddc745268ad532a8b780.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/756-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download

memory/972-55-0x0000000075781000-0x0000000075783000-memory.dmp

Download

memory/972-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download