emotet | 73b993ce06fe85508e4695da71be1eacf4d020e79a1bb870cde56f26e8129fff

Analysis

Target
emotet_exe_e5_73b993ce06fe85508e4695da71be1eacf4d020e79a1bb870cde56f26e8129fff_2022-03-20__221707.dll
Size 480KB
Sample220320-17yl9agcb7
SHA256 73b993ce06fe85508e4695da71be1eacf4d020e79a1bb870cde56f26e8129fff
MD5 38162108bb4e22393475f1108aab290c
SHA1 06fc0918bfc627408c277a6072a1ffff3061ad0d
SHA512 68374b6ffe85ae284799e0e7de3f8e0e45bce7e1b5f352f9e2d7fb87c0477aefc953ea9d3442a5319c0efe5a75fa4e6372d277035e53e6a133b853a3c3624518
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	regsvr32.exe
1392	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1392	1236	regsvr32.exe	79
PID 1236 wrote to memory of 1392	1236	regsvr32.exe	79
PID 1236 wrote to memory of 1392	1236	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73b993ce06fe85508e4695da71be1eacf4d020e79a1bb870cde56f26e8129fff_2022-03-20__221707.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73b993ce06fe85508e4695da71be1eacf4d020e79a1bb870cde56f26e8129fff_2022-03-20__221707.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392

memory/1392-130-0x00000000007A0000-0x00000000007C7000-memory.dmp

Download