emotet | 2bc9d5c6fda79d2b44721855c4742bd7a40ce2bb3b2674d62e322298d79dd06d

Analysis

Target
emotet_exe_e5_2bc9d5c6fda79d2b44721855c4742bd7a40ce2bb3b2674d62e322298d79dd06d_2022-03-04__180951.dll
Size 412KB
Sample220304-wr2lrafec5
SHA256 2bc9d5c6fda79d2b44721855c4742bd7a40ce2bb3b2674d62e322298d79dd06d
MD5 932bf8764d5c0cd61a30766aa6b3e56f
SHA1 70a38c908e41efbbc23ca3b003478d9fdcd21421
SHA512 8369daca370f6f56454e1f144c27f9c3744a41a8f33b786a27b6b35e78aacf94666e2c23c440fc1a7dec6a82ca4ecf7b8c0a7d170bbd73b45c5f5b78274371f7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1640	948	regsvr32.exe	27
PID 948 wrote to memory of 1640	948	regsvr32.exe	27
PID 948 wrote to memory of 1640	948	regsvr32.exe	27
PID 948 wrote to memory of 1640	948	regsvr32.exe	27
PID 948 wrote to memory of 1640	948	regsvr32.exe	27
PID 948 wrote to memory of 1640	948	regsvr32.exe	27
PID 948 wrote to memory of 1640	948	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2bc9d5c6fda79d2b44721855c4742bd7a40ce2bb3b2674d62e322298d79dd06d_2022-03-04__180951.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2bc9d5c6fda79d2b44721855c4742bd7a40ce2bb3b2674d62e322298d79dd06d_2022-03-04__180951.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

memory/948-55-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Download

memory/1640-56-0x0000000076B81000-0x0000000076B83000-memory.dmp

Download

memory/1640-57-0x0000000000650000-0x0000000000677000-memory.dmp

Download