emotet | 27e2c2c7f2421afcbc6c6afe1e720bf5bacf0e75e652e77f261be3ac055db3d3

Analysis

Target
ad5ab5773aa2b659d2fdfc29598adbbd.dll
Size 805KB
Sample220304-lpw85secc4
SHA256 27e2c2c7f2421afcbc6c6afe1e720bf5bacf0e75e652e77f261be3ac055db3d3
MD5 ad5ab5773aa2b659d2fdfc29598adbbd
SHA1 ae11a2a517a7d69a195ac866926c1ad2c3d8a8a4
SHA512 6789a8ac2cdde80bcb284e1c71117f83d5624ae1adb1d462398e4c4c03a1d45aa1144016e3f45c8e134ab20109b8634fe562dd882e9e83e704a1962c8e24d093
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
948	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27
PID 1140 wrote to memory of 948	1140	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad5ab5773aa2b659d2fdfc29598adbbd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad5ab5773aa2b659d2fdfc29598adbbd.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

memory/948-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Download

memory/948-56-0x0000000000490000-0x00000000004B7000-memory.dmp

Download

memory/1140-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download