emotet | 78cefbb8b32585ebabe46c5a3c046355be4ee5ae7f2d61755bbf2382ede5fc9f

Analysis

Target
emotet_exe_e5_78cefbb8b32585ebabe46c5a3c046355be4ee5ae7f2d61755bbf2382ede5fc9f_2022-03-08__000130.dll
Size 400KB
Sample220308-abhcaaheb2
SHA256 78cefbb8b32585ebabe46c5a3c046355be4ee5ae7f2d61755bbf2382ede5fc9f
MD5 a3c1ef42f77ea23551233310a88dbabf
SHA1 80e987b71c4129225c4c6e434bd1f1ff425bcf44
SHA512 bdfece492da44d3c8b7bb4c23b6838e5f2df3d0acbb5b4b920acd6380927e9a8b33659f9a5aef71fb154f10e84a95c6b5aec7045c6f7d05b434bd1999e590523
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1464	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27
PID 1792 wrote to memory of 1464	1792	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78cefbb8b32585ebabe46c5a3c046355be4ee5ae7f2d61755bbf2382ede5fc9f_2022-03-08__000130.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78cefbb8b32585ebabe46c5a3c046355be4ee5ae7f2d61755bbf2382ede5fc9f_2022-03-08__000130.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

memory/1464-55-0x00000000752A1000-0x00000000752A3000-memory.dmp

Download

memory/1464-56-0x00000000009B0000-0x00000000009D7000-memory.dmp

Download

memory/1792-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Download