emotet | 4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283

Analysis

Target
emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll
Size 567KB
Sample220319-af42vaggf2
SHA256 4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283
MD5 914e260e76725cb7b1b0be995dcb7dfc
SHA1 a1585fddb70ec6e5df0401aa7499cbf1c0a772b5
SHA512 044ca37253d17b408375631e6a64e1cb6e2d22588eb24e397150e7cc95b4d145e94ee52f0dbe8584de1616cff67d7e8dc60e0ebd667825e1248c4b5ee50856ed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1684	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

memory/1216-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download

memory/1684-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1684-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download