emotet | b99a0e16f27e306b7f1eac5528c3777281d2b489898ab184e56dcacbbfd8e4fa

Analysis

Target
emotet_exe_e4_b99a0e16f27e306b7f1eac5528c3777281d2b489898ab184e56dcacbbfd8e4fa_2022-03-14__233804.dll
Size 997KB
Sample220314-3nagesdge7
SHA256 b99a0e16f27e306b7f1eac5528c3777281d2b489898ab184e56dcacbbfd8e4fa
MD5 aff41f0d74abffa7be4cade9b2adfbc3
SHA1 cd9996769f6c82ce68a28d257a2bedf5093472ec
SHA512 63bc5b468120dc7c6a02ac26b21aaa562f5460bf540b5ba6bfd911173aba524b0063dd1f06d4b6ab8a99a0821cbfb7007d22703d884a26914e4ee89e8add31e2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3808	regsvr32.exe
3808	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3808	1792	regsvr32.exe	80
PID 1792 wrote to memory of 3808	1792	regsvr32.exe	80
PID 1792 wrote to memory of 3808	1792	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b99a0e16f27e306b7f1eac5528c3777281d2b489898ab184e56dcacbbfd8e4fa_2022-03-14__233804.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b99a0e16f27e306b7f1eac5528c3777281d2b489898ab184e56dcacbbfd8e4fa_2022-03-14__233804.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808

memory/3808-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download