emotet | ba813cc49e7eb428a35bc46150b60070eb8a505f32dd635996d1477bec5b055a

Analysis

Target
emotet_exe_e5_ba813cc49e7eb428a35bc46150b60070eb8a505f32dd635996d1477bec5b055a_2022-03-20__221706.dll
Size 480KB
Sample220320-17yl9agcb8
SHA256 ba813cc49e7eb428a35bc46150b60070eb8a505f32dd635996d1477bec5b055a
MD5 95879db73a204b4b7562d8360ea4a4d5
SHA1 f3db1650673a41416509fb5a5f3305cafa52ad73
SHA512 6eb27b137d79fe2f725814d12ca8d86089e93b72426e23dfc87a3fc92225ae03cd03dab59eed932767d6d4c19e0b6afcbaf23ddb7e22a3038670a1ec397e51aa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2680	regsvr32.exe
2680	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2680	2136	regsvr32.exe	80
PID 2136 wrote to memory of 2680	2136	regsvr32.exe	80
PID 2136 wrote to memory of 2680	2136	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ba813cc49e7eb428a35bc46150b60070eb8a505f32dd635996d1477bec5b055a_2022-03-20__221706.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ba813cc49e7eb428a35bc46150b60070eb8a505f32dd635996d1477bec5b055a_2022-03-20__221706.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

memory/2680-130-0x0000000000B50000-0x0000000000B77000-memory.dmp

Download