emotet | e5726f029febfaabde9b31c4ca6fbd578eda5b4b19c46d71e75eb9739f0f48e3

Analysis

Target
29970559528218b64c0457a32986fe65.dll
Size 412KB
Sample220305-f1fsmsgca8
SHA256 e5726f029febfaabde9b31c4ca6fbd578eda5b4b19c46d71e75eb9739f0f48e3
MD5 29970559528218b64c0457a32986fe65
SHA1 0e99dafdaf29ade5660f7787de24c6bda319acf9
SHA512 8813c0a10cd9330827653e2b3bdaf7597b3a7a5fbf148d1d1e9990f44a154a35a7365cb77a6f00f6dacead3cd1fe11b306821c528665eae46422aa292ca661dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1736	1796	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\29970559528218b64c0457a32986fe65.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\29970559528218b64c0457a32986fe65.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

memory/1736-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1736-57-0x0000000000550000-0x0000000000577000-memory.dmp

Download

memory/1796-55-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download