emotet | 197898e33b2d7549ebe82aa80f15762cadce3839c2edabdb6961251e607dab3a

Analysis

Target
emotet_exe_e5_197898e33b2d7549ebe82aa80f15762cadce3839c2edabdb6961251e607dab3a_2022-03-04__180950.dll
Size 412KB
Sample220304-wr2lrafec6
SHA256 197898e33b2d7549ebe82aa80f15762cadce3839c2edabdb6961251e607dab3a
MD5 ac4919f27678a6afb7d593f9f2b0192e
SHA1 78339c5dd301015dffa29a7b98aab2f8a403cafd
SHA512 0ff3b68eb835720f3caf6e238b8dfabf0472f51c333cafa4b9595379eb4e23d108a72abf5ae3f06ee8c529ae47ac8a3bf52bf70ad30a029b5f51f551284207a9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27
PID 1516 wrote to memory of 1936	1516	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_197898e33b2d7549ebe82aa80f15762cadce3839c2edabdb6961251e607dab3a_2022-03-04__180950.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_197898e33b2d7549ebe82aa80f15762cadce3839c2edabdb6961251e607dab3a_2022-03-04__180950.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

memory/1516-54-0x000007FEFB981000-0x000007FEFB983000-memory.dmp

Download

memory/1936-55-0x0000000075251000-0x0000000075253000-memory.dmp

Download

memory/1936-57-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download