emotet | 52053e9f2025a8d35bbd325e7c8998bda5db049f87553b4d40d1e5bc6a111410

Analysis

Target
84b3738690f1e17b17e8910722afb1a1.dll
Size 612KB
Sample220310-lpyrzaeec2
SHA256 52053e9f2025a8d35bbd325e7c8998bda5db049f87553b4d40d1e5bc6a111410
MD5 84b3738690f1e17b17e8910722afb1a1
SHA1 023590999a7aa9c25ab4cbdee12b2a5570669b22
SHA512 0a91277ff506ab3f74897684a75c92327a3596ebb9c6d2562732799ee1c47a38ac50b1a6422ff3ead82452107a2c699ae108c571ff8f869052968860ff00d395
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1492	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\84b3738690f1e17b17e8910722afb1a1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\84b3738690f1e17b17e8910722afb1a1.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

memory/1412-54-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

memory/1492-55-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/1492-56-0x0000000000380000-0x00000000003A7000-memory.dmp

Download