emotet | 9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c

Analysis

Target
emotet_exe_e4_9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c_2022-03-15__000446.dll
Size 997KB
Sample220315-ac794aeae4
SHA256 9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c
MD5 964eb180db6b4b3c0cd758695eb4a0ce
SHA1 8f364400532439c506beacd6a1360a4baa1a87a4
SHA512 055fd2c0cc78eabcb0930bd61033a2d7396ced402d6e5585f8629af2002a2bf8c3de17f2338fc7ad01755984db8983a66b9e795d7af13dd4d7c1ccef806df6aa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3488	regsvr32.exe
3488	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3488	3660	regsvr32.exe	79
PID 3660 wrote to memory of 3488	3660	regsvr32.exe	79
PID 3660 wrote to memory of 3488	3660	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c_2022-03-15__000446.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9dfc8bdb4edd4181e916f5e2a131ef379a529bc2da83c7d6d5c7881bb54d960c_2022-03-15__000446.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

memory/3488-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download