emotet | 35266f358ca70e3ee551ad2a64781064ff14caeb79aeb74c3936776d00a969b4

Analysis

Target
emotet_exe_e5_35266f358ca70e3ee551ad2a64781064ff14caeb79aeb74c3936776d00a969b4_2022-03-20__221706.dll
Size 480KB
Sample220320-17yl9agcb9
SHA256 35266f358ca70e3ee551ad2a64781064ff14caeb79aeb74c3936776d00a969b4
MD5 c5087ad1115909ac2a32466b2602e81b
SHA1 daed0a77ed1733ffbd2f3e8d66c92e11778f79c4
SHA512 600e2029b6c1434aea06ccfd10eede8dadbdf71f6629e1b5a25ba607b05c4622983129d131b70aa7d65c9ed51c2017529610a42c7483d50e81a9e9764b58fce7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4156	regsvr32.exe
4156	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4156	3828	regsvr32.exe	80
PID 3828 wrote to memory of 4156	3828	regsvr32.exe	80
PID 3828 wrote to memory of 4156	3828	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_35266f358ca70e3ee551ad2a64781064ff14caeb79aeb74c3936776d00a969b4_2022-03-20__221706.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_35266f358ca70e3ee551ad2a64781064ff14caeb79aeb74c3936776d00a969b4_2022-03-20__221706.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

memory/4156-133-0x0000000002950000-0x0000000002977000-memory.dmp

Download