emotet | 36135071aba64f7c0364f132d02efff5cb379edbd230ef0cb4f9f5e5efd96f47

Analysis

Target
emotet_exe_e4_36135071aba64f7c0364f132d02efff5cb379edbd230ef0cb4f9f5e5efd96f47_2022-03-18__193725.dll
Size 585KB
Sample220318-ycd81sead4
SHA256 36135071aba64f7c0364f132d02efff5cb379edbd230ef0cb4f9f5e5efd96f47
MD5 a8710593794fea02b47aab01b305965b
SHA1 d3980d7d3d2ff809b935f43d059c3e12c0018c70
SHA512 283b6c274e8a304b936c5725464626d145805e88b0d38111ac0aba11f61b79f2265d04c8501581918fc18fe34d0ba603ef26cd488a0510abee46aaf017c60fec
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	regsvr32.exe
940	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 940	2924	regsvr32.exe	78
PID 2924 wrote to memory of 940	2924	regsvr32.exe	78
PID 2924 wrote to memory of 940	2924	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_36135071aba64f7c0364f132d02efff5cb379edbd230ef0cb4f9f5e5efd96f47_2022-03-18__193725.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_36135071aba64f7c0364f132d02efff5cb379edbd230ef0cb4f9f5e5efd96f47_2022-03-18__193725.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940

memory/940-131-0x0000000010000000-0x0000000010028000-memory.dmp

Download