emotet | 3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91

Analysis

Target
emotet_exe_e4_3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91_2022-03-05__000200.dll
Size 817KB
Sample220305-ab2e6agaa3
SHA256 3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91
MD5 a3a59b7cef8a308bfb519b270ecca4c9
SHA1 c2b4656dea3bd66a029cab13248c1b89d12c4b89
SHA512 58c58b991642a0660e841067d5f6a209ab71bccf147fd931d3917c4bfffa717e610303034c25a3f8a2bf166219f71d543269c5c3df01e648cc60c573ab6b7065
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
64	regsvr32.exe
64	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 64	3504	regsvr32.exe	55
PID 3504 wrote to memory of 64	3504	regsvr32.exe	55
PID 3504 wrote to memory of 64	3504	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91_2022-03-05__000200.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91_2022-03-05__000200.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64

memory/64-131-0x0000000004650000-0x0000000004678000-memory.dmp

Download