emotet | fc9597bfbdbf689b42497a3a08489e47e8175a3a3b2d6a9405af7317121d5c0d

Analysis

Target
emotet_exe_e4_fc9597bfbdbf689b42497a3a08489e47e8175a3a3b2d6a9405af7317121d5c0d_2022-03-16__164823.dll
Size 736KB
Sample220316-vbnjhsfch2
SHA256 fc9597bfbdbf689b42497a3a08489e47e8175a3a3b2d6a9405af7317121d5c0d
MD5 7aa6d444216946e1d2c8c0c2284f6b55
SHA1 6cfde3f38e1308eee4df2092df4f13f47d3d8841
SHA512 a6462d2996bcc3aa3a4ebd2d92af12c3fa29810084d890556fc5d12d08320498d4cca5e552aafdbce5edc09831297ac4b3266dfb7acf02bac7ad151e671db4a0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4872	regsvr32.exe
4872	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4872	3556	regsvr32.exe	81
PID 3556 wrote to memory of 4872	3556	regsvr32.exe	81
PID 3556 wrote to memory of 4872	3556	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fc9597bfbdbf689b42497a3a08489e47e8175a3a3b2d6a9405af7317121d5c0d_2022-03-16__164823.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fc9597bfbdbf689b42497a3a08489e47e8175a3a3b2d6a9405af7317121d5c0d_2022-03-16__164823.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

memory/4872-133-0x0000000002800000-0x0000000002835000-memory.dmp

Download