emotet | 0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68

Analysis

Target
emotet_exe_e4_0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68_2022-03-19__000730.dll
Size 585KB
Sample220319-aexldaggc3
SHA256 0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68
MD5 33803aaca1a1cb9cd99f7eb54211dfbf
SHA1 c9fdf51868fbb844dc783309efa89003a118cea6
SHA512 337f9d8edc45bbb84691d203efb33128b5c21a16e9eeb4e0ba00358b249d0aeeab17d66b526ee24d775d23a254b7a74d0a157e12284665a33d6808c740953978
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	regsvr32.exe
1300	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1300	1532	regsvr32.exe	79
PID 1532 wrote to memory of 1300	1532	regsvr32.exe	79
PID 1532 wrote to memory of 1300	1532	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68_2022-03-19__000730.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68_2022-03-19__000730.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300

memory/1300-130-0x0000000010000000-0x0000000010028000-memory.dmp

Download