emotet | 928f548bbeff073c25d538a69a1892cbfbab2a95644be977b7053e1242ff9c15

Analysis

Target
emotet_exe_e4_928f548bbeff073c25d538a69a1892cbfbab2a95644be977b7053e1242ff9c15_2022-03-18__193723.dll
Size 585KB
Sample220318-ycdx9aeac8
SHA256 928f548bbeff073c25d538a69a1892cbfbab2a95644be977b7053e1242ff9c15
MD5 638e425d9872d4004e560c6907f4c824
SHA1 b595fe1f1c37d4e0669b4a697dc8acea828af721
SHA512 ada53d8f196ee2fb493dbefe2a886ebd2330bb79f83c7da498126ea7030e293c99fd703a5e5b1a7c69c0566921f79334faa075c15fa1ebc31d5879be05fa309c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	regsvr32.exe
1740	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1740	580	regsvr32.exe	84
PID 580 wrote to memory of 1740	580	regsvr32.exe	84
PID 580 wrote to memory of 1740	580	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_928f548bbeff073c25d538a69a1892cbfbab2a95644be977b7053e1242ff9c15_2022-03-18__193723.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_928f548bbeff073c25d538a69a1892cbfbab2a95644be977b7053e1242ff9c15_2022-03-18__193723.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740

memory/1740-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download