emotet | 300026de2f2a5a827b7f8baef9e258ca167db584987ba747ed63ef25b41b9479

Analysis

Target
3f82671a332e2a1e55533d8dc9378856.dll
Size 797KB
Sample220307-ldly2acfc7
SHA256 300026de2f2a5a827b7f8baef9e258ca167db584987ba747ed63ef25b41b9479
MD5 3f82671a332e2a1e55533d8dc9378856
SHA1 11edf5355bbe1e3dc51cdbe44eccd8173a201004
SHA512 6ee3632d1c65f7a003533cc2446ec4dedb1794ca3192df5923794766ee47ec2e1abb717734fd91abf976864e84f1de5e0758ee30b233bb1a14441bf856334724
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1768	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29
PID 1904 wrote to memory of 1768	1904	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f82671a332e2a1e55533d8dc9378856.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f82671a332e2a1e55533d8dc9378856.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768

memory/1768-55-0x0000000075F71000-0x0000000075F73000-memory.dmp

Download

memory/1768-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1904-54-0x000007FEFC1E1000-0x000007FEFC1E3000-memory.dmp

Download