emotet | 978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd

Analysis

Target
emotet_exe_e4_978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd_2022-03-19__102351.dll
Size 664KB
Sample220319-mfdwwaffe9
SHA256 978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd
MD5 a98825a52a0f8bad8e5a96b0806d2eaf
SHA1 193051c153ec6d9e5cf63080127fe47053fb7929
SHA512 ede44591548ed7a23e8f5c91287ab692834d335a66fcf106e45b7f8479a0c0fcebdf1d6fc5423bfdf602694b1b7fb23f5add4992b0daf54eb8ce5f5f3a594b0d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd_2022-03-19__102351.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd_2022-03-19__102351.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

memory/1980-55-0x0000000074C61000-0x0000000074C63000-memory.dmp

Download

memory/1980-56-0x0000000000200000-0x0000000000228000-memory.dmp

Download

memory/2004-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download